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PREFACE 


One  of  the  main  fields  of  interest  of  the  Flight  Mechanics  Panel  is: 

“Operational  problems  including  such  subjects  as  operational  experience,  safety,  take  off  and  landing,  all  weather 
operation  and  low  altitude  flight”. 

The  Flight  Mechanics  Panel  plays  a  unique  role  among  the  Technical  Panels  of  AGARD  by  addressing  the  overall 
design  of  aircraft.  This  explains  a  continuous  activity  of  this  panel  devoted  to  the  lessons  from  operational  experience  on 
flight  mechanics  and  design  of  aircraft  and  systems.  This  subject  is  covered  by  symposia  at  regular  intervals,  the  first  of 
which  took  place  in  1970  in  Baden-Baden,  Federal  Republic  of  Germany.  It  was  entitled:  “Lessons  with  emphasis  on 
Flight  Mechanics,  from  operating  experience,  incidents  and  accidents”  (CP  70). 

The  following  subjects  were  covered: 

-  use  of  recordings  for  routine  flight  operations 

-  rough  field  operations 

-  safety  margins  for  take  off  and  landing,  high  speed  and  low  level  flying 

-  accident  surveys,  including  V/STOL  and  general  aviation. 

The  second  symposium  was  arranged  in  1976  in  Sandefjord,  Norway,  with  the  following  title:  “Aircraft 
operational  experience  and  its  impact  on  safety  and  survivability”. 

Again  a  first  session  was  devoted  to  methods  for  accident  statistics  and  analysis.  The  others  were  strongly  oriented 
toward  design  (a  subject  which  was  not  covered  by  the  1970  symposium): 

-  design  practices  for  aircraft  safety 

-  design  for  aircraft  vulnerability  and  survivability. 

Then  a  small  session  was  devoted  to  aircrew  considerations. 

It  can  be  seen  from  the  description  of  the  above  two  meetings  that  the  second  one  put  strong  emphasis  on  the  design 
aspect  with  little  consideration  of  the  man-machine  interface. 

From  1976  the  major  change  which  has  occurred  in  the  design  of  aircraft  is  the  general  use  of  electrical  controls  in 
combat  aircraft  (fly-by-wire)  together  with  sophisticated  systems  used  to  provide  man-machine  interfaces,  enabling  an 
increase  of  efficiency  of  the  crew,  together  with  an  increase  of  safety.  Thus  the  periodic  review  of  the  lessons  from 
experience  which  it  was  decided  would  be  the  subject  for  the  spring  1983  meeting  of  the  Flight  Mechanics  Panel  was 
arranged  in  order  to  put  some  emphasis  on  these  two  major  subjects. 

The  first  session,  usually  devoted  to  the  progress  made  in  recording  techniques,  was  reoriented  toward  the  reporting 
systems  used  in  various  countries  which  exert  influence  on  operations  and  design;  the  second  session  to  adverse 
environment  including  rotorcraft  icing,  operation  from  high  altitude  airfields,  windshear,  atmospheric  electricity.  The 
third  session  was  devoted  to  survivability  after  failure.  Examples  were  given  of  new  electrical  control  systems.  The  last 
session,  the  largest  one  with  seven  papers,  was  devoted  to  the  man-machine  interface. 

Much  has  been  learned  from  the  discussions  held  after  each  presentation;  it  is  hardly  possible  to  sum  up  in  a  few 
words  what  could  be  the  conclusions  and  recommendations  about  such  a  broad  area  covered  by  this  symposium. 

Nevertheless  the  following  remarks  can  be  made: 

( 1 )  detection  of  incidents,  even  minor  ones,  is  a  means  of  preventing  accidents;  accident  prevention  relies  on  a  closed 
loop  information  system  which  must  be  usable  by  any  crew  (civil  or  military)  and  be  anonymous  in  order  to  collect  the 
right  information  without  prejudice  to  any  crew  member.  This  is  well  shown  by  Session  I  with  a  special  mention  of  the 
papers  on  incident  reporting  systems  by  NASA,  and  Air  France  which  illustrate  this  point  quite  well. 

(2)  progress  has  yet  to  be  made  on  knowledge  of  adverse  conditions,  weather  conditions  (sandstorms,  windshears,  icing) 
and  definition  of  specific  regulations  for  flying  in  difficult  operational  conditions  (rough  airfields,  high  altitude,  high-slope 
runways  etc...). 
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(3)  the  most  controversial  subject  is  that  of  the  man-machine  interface;  great  advances  have  been  made  in  that  area  with 
the  new  head-up  and  head-down  display  and  new  control  systems.  But  crews  are  always  discussing  the  best  means  to  use, 
the  training  needed  to  make  proper  use  of  new  systems,  the  proving  of  new  information  systems. 

On  this  subject  the  reader  could  begin  with  the  stimulating  paper  by  Farley  entitled  “Modem  Flight  Instrument 
Displays  as  a  Major  Military  Aviation  Flight  Safety  Weakness”  followed  by  the  entire  session  IV. 

In  conclusion,  it  can  be  said  that  such  symposia  are  very  useful  as  they  provide  a  unique  opportunity  for  discussion 
between  aircraft  designers  and  users.  Thus,  it  is  appropriate  that  another  meeting  of  this  type  be  arranged  in  a  few  years, 
when  the  emphasis  could  be  on  the  subject  of  man-machine  interface  and  the  increasing  use  of  digital  computers  and 
associated  controls  and  displays,  as  they  could  influence  the  design  of  aircraft  from  an  operational  viewpoint. 


L’un  des  principaux  domaines  d’interet  de  la  Commission  de  Mecanique  du  Vol  est  defini  comme  suit: 

“Problemes  operationnels,  incluant  l’experience  operationnelle,  la  securite,  le  decollage  et  l’atterrissage,  les  operations 
tous-temps,  et  le  vol  a  basse  altitude”. 

En  outre,  la  Commission  de  Mecanique  du  Vol  joue  un  role  unique  parmi  les  Commissions  Techniques  d’AGARD  en 
traitant  de  la  conception  d’enscmble  de  I’adronef. 

Ceci  explique  que  la  Commission  exerce  une  activite  continue  dans  le  domaine  des  lemons  de  l’experience 
operationnelle  sur  la  mecanique  du  vol  et  la  conception  de  1’aeronef  et  de  ses  systemes. 

Ce  sujet  est  done  traite  par  des  symposiums  tenus  a  intervalles  r£guliers. 

Le  premier  eut  lieu  en  1970  a  Baden-Baden,  Allemagne  Federate,  sous  le  titre:  “Les  lemons  de  Mecanique  du  Vol 
tirees  de  1’experience  operationnelle  des  incidents,  des  accidents”  (CP  70). 

Les  sujets  suivants  furent  traites: 

-  utilisation  des  enregistrements  pour  les  operations  a6riennes  quotidiennes 
emploi  des  terrains  irreguliers 

-  marges  de  securite  a  I’envol  et  a  l’atterrissage,  en  vol  a  grande  vitesse  et  basse  altitude 

-  revue  des  accidents,  incluant  les  V/STOL  et  1’Aviation  Generate. 

Le  second  fut  organise  en  1976  a  Sandefjord,  Norvege;  son  titre  etait:  “L’experience  operationnelle  sur  aeronefs  et 
son  impact  sur  la  securite”. 

A  nouveau  une  premiere  session  fut  consacree  aux  methodesd’analyse  des  accidents  et  aux  statistiques 
correspondantes.  Les  autres  furent  principalement  orientees  vers  la  conception  (sujet  non  traite  au  symposium  de  1970): 

-  methodes  pratiques  pour  assurer  la  securite  des  la  conception 

-  conception  orientiSe  vers  la  securite  et  la  survie. 

Une  petite  session  fut  consacree  au  probleme  de  ('equipage. 

On  peut  voir  d’apres  la  description  du  sujet  des  ces  deux  reunions  que  la  seconde  insiste  plus  sur  la  conception  que 
sur  1'interface  homme-machine. 

A  partir  de  1976,  une  revolution  transforma  la  conception  de  Fa6ronef:  I’emploi  generalise  de  commandes  eiectriques 
sur  les  avions  de  combat  (commandes  par  fil)  et  en  meme  temps,  I’emploi  de  systemes  sophistiqu6s  d’interface  homme- 
machine.  permettant  d’accroitre  i’efficacite  de  1’gquipage  en  meme  temps  que  sa  securite. 

C’est  ainsi  qu’il  fut  decide  de  choisir  la  revue  des  Iefons  de  l’experience  comme  sujet  de  la  reunion  de  1983  de  la 
Commission  de  Mecanique  du  Vol,  afin  d’insister  sur  ces  deux  sujets  d 'importance  primordiale. 

La  premiere  session  consacree  dans  les  precedents  symposiums  aux  progrts  des  techniques  d’enregistrement,  est 
reorientee  vers  les  systemes  de  comptes  rendus  utilises  dans  divers  pays  pour  exercer  une  influence  sur  les  operations  et  la 
conception. 

La  seconde  session  est  consacree  a  1’environnement  adverse,  incluant  le  givrage  heiicopteres,  les  operations  sur 
altiports,  les  gradients  de  vent,  I’eiectricite  atmospherique. 

La  troisteme  session  est  consacree  k  la  survie  apres  panne  et  illustree  par  des  exemples  des  nouveaux  systemes  de 
commandes  eiectriques. 
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La  demiere  session,  la  plus  longue,  avec  sept  communications,  est  consacree  a  l’interface  homme-machine. 

Les  discussions  apres  chaque  presentation  ont  ete  riches  d'enseignements;  il  est  difficile  de  resumer  en  quelques 
mots  ce  que  peuvent  etre  les  conclusions  et  recommandations  concemant  le  vaste  sujet  de  ce  symposium. 

Cependant,  on  peut  faire  les  remarques  suivantes: 

( 1 )  la  detection  d’incidents,  meme  ceux  considers  comme  mineurs,  est  un  moyen  de  prevenir  les  accidents:  la 
prevention  des  accidents  repose  sur  un  systeme  d’informafions  dote  d’une  “boucle  de  retour”,  pouvant  etre  utilise  par 
n’importe  quel  equipage  (civil  ou  militaire)  et  etre  anonyme  afin  de  collecter  l’information  sans  porter  prejudice  a  aucun 
membre  d  'equipage.  Ceci  est  bien  demontre  par  la  Session  I  et  en  particular  par  les  communications  sur  le  NASA 
Reporting  System  et  sur  le  systeme  employe  par  Air  France,  qui  illustrent  bien  ce  point  de  vue. 

(2)  Des  progres  doivent  encore  etre  faits  pour  connaitre  les  conditions  meteorologiques  ad  verses  (tempetes  de  sable, 
gradients  de  vent,  givrage)  et  pour  d6finir  des  regies  operationnelles  specifiques  pour  voter  dans  des  conditions 
operationnelles  difficiles  (pistes  irregulieres,  pistes  en  altitude,  a  forte  pente,  etc...). 

(3)  Le  sujet  le  plus  controversy  est  celui  de  l'interface  homme-machine;  de  grands  progres  ont  ete  faits  a  cet  £gard  avec 
les  nouveaux  systemes  de  presentation  tele  haute  ou  tete  basse  et  les  nouveaux  systemes  de  commande.  Mais  les 
equipages  discutent  toujours  du  meilleur  systeme,  de  1’entralnement  souhaitable  pour  I’employer,  de  la  methode  pour  en 
demontrer  la  validity. 

Surce  sujet,  le  lecteurdu  compte  rendu  du  symposium  pourra  commencer  par  la  communication  de  Farley  intitule 
“La  presentation  moderne  des  Instruments  de  Vol,  faiblesse  majeure  de  la  Sycurity  Aerienne  des  operations  militaires”. 

Apres  lecture  de  ce  texte,  le  lecteur  ne  pourra  faire  autrement  que  de  lire  entierement  la  Session  IV. 

En  conclusion  finale,  on  peut  dire  que  de  tels  symposiums  sont  tres  utiles  en  donnant  au  constructed  une  occasion 
unique  de  discuter  avec  les  utilisateurs. 


J.E.Cayot 
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INVESTIGATION,  REPORTING  AND  ANALYSIS 
OF  US  ARMY  AIRCRAFT  ACCIDENTS 


M.  J.  Reeder 
G.  D.  Lindsey 
D,  S.  Ricketson,  Jr. 

US  Army  Safety  Center 
Fort  Rucker,  Alabama  36362 


SUMMARY 


Each  year  aircraft  accidents  result  in  large  losses  of  US  Army  equipment  and  personnel  resources* 
This  paper  describes  these  losses  in  terms  of  aircraft  and  cause  factors  involved.  Also  presented  is  a 
system-oTiented  approach  used  in  the  investigation*  reporting  and  analysis  of  these  accidents.  The 
results  include  identification  of  lessons  learned  with  respect  to  cost*  type  aircraft*  flight  tasks, 
cause  factors  and  system  inadequacies  which  produced  the  cause  factors.- 

a: 

INTRODUCTION  ' 


Problem.  From  fiscal  year  (FY)  78-82  the  Army  has  experienced  an  average  of  91  major  aircraft 
accidents  per  year.  These  accidents  have  produced  an  average  of  27  fatal  and  65  non-fatal  injuries  and 
$36. 8M  in  costs  per  year.  Figure  1  shows  the  cause  factors  of  these  accidents  and  it  can  be  seen  that 
human  error  is  by  far  the  largest.  The  problem  for  the  safety  community  is  to  identify  sources  of  these 
cause  factors  in  the  Army  system,  take  corrective  action  and  thereby  make  the  system  more  efficient  and 
effective. 


Figure  1  -  Percentage  of  human  error  and  materiel  failure 
causes  of  major  Army  aircraft  accidents  from  FY  78-82 
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Class  A,B,  and  C  accidents  costing  more  than  $10*000 


in  injuries  and  property  damage. 


Approach.  In  the  accident  model  presented  in  Figure  2  there  are  12  Items  outlined  which  are  basic 
elements  of  the  Army  system.  When  one  or  more  of  these  elements  Is  out  of  tolerance,  an  overload  (Item 
13)  is  placed  on  the  system  role  of  personnel,  materiel  or  the  environment  (item  14).  When  personnel  or 
materiel  in  the  system  cannot  cope  with  the  overload,  then  personnel  make  errors,  materiel  falls/ 
malfunctions  or  the  environment  is  allowed  to  have  a  negative  influence  on  the  performance  of  personnel 
or  equipment  (item  15).  Host  human  errors,  materiel  failures  and  environmental  factors  do  not  lead  to 
accidents  (item  16).  However,  when  circumstances  operate  unfavorably  accidents  occur  (item  17). 


Figure  2  -  Accident  model 


This  accident  model  was  used  to  develop  an  approach  to  accident  investigation,  analysis  and  preven¬ 
tion.  Table  1  shows  this  3W  approach.  It  requires  each  investigator  to  answer  what  happened,  what 
caused  it  to  happen,  and  what  to  do  about  it  with  respect  to  man,  machine  and  environmental  cause 
factors.  It  can  be  seen  that  accident  cause  factors  originate  from  inadequacies  in  the  system.  When 
remedies  are  applied  which  correct  these  system  inadequacies,  then  human  errors,  materiel  failures  and 
the  environment's  affect  on  man  and  machine  are  reduced.  As  a  result,  fewer  accidents  occur  and  a  more 
efficient  and  effective  system  is  produced. 


Table  1  -  3W  approach  to  accident  Investigation 
analysis  and  prevention 


WHAT  HAPPENED 

WHAT  CAUSED  IT 

WHAT  TO  DO  ABOUT  IT 

Human  Errors 

Materiel  Failures 

Environmental  Factors 

System  Inadequacies 

Kerned lal  Measures 

An  example  of  the  difference  in  investigating  and  reporting  using  the  3W  approach  can  be  seen  by 
comparing  the  accident  reports  in  Tables  2  and  3.  Both  reports  are  based  on  an  OH-58  accident.  Table  2 
rspresents  the  type  of  informat  on  reported  before  implementation  of  the  3W  approach.  As  can  be  seen,  the 
investigation  sto  ad  with  r’  .dentlflcatlon  of  pilot  error.  The  key  question,  "Why  didn't  the  pilot 
use  the  landing  1  '■»*"  we.  ,t  answered. 


IABLE  2  -  Example  of  Information  received  on  an  OH-58  accident 
before  the  3W  approach  was  implemented 


WHAT  HAPPENED 
(Cause  Factor) 


Pilot  erred  in  that  he  did 
not  use  the  landing  light 
and  allowed  the  tail  rotor 
to  strike  tree  branches 
during  night  landing. 


WHAT  TO  DO 
(Remedy) 


Unit  safety  meetings  should 
include  a  discussion  of  facts 
surrounding  this  mishap. 
Particular  attention  should 
be  focused  on  the  proper  use 
of  the  landing  light. 


Unit  should  also  examine  the 
adequacy  of  their  night 
flying  policy/t raining. 


Table  3  shows  the  type  of  information  reported  using  the  3W  approach.  It  can  be  seen  that  the 
critical  question  of  why  the  pilot  did  not  use  the  landing  light  is  answered  through  the  identification 
of  system  inadequacies.  Consequently,  remedial  measures  In  the  third  column  address  system  Inadequacies 
which  are  the  root  causes  of  the  pilot  error.  When  these  system  inadequacies  are  corrected,  the  over¬ 
load  is  relieved,  pilot  errors  are  reduced  and  accidents  from  these  errors  become  less  likely. 


Table  3  -  Example  of  information  received  on  the 
same  OH-58  accident  using  the  3W  approach 


WHAT  HAPPENED 
(Cause  Factor) 


WHAT  CAUSED  IT 
(System  Inadequacy) 


WHAT  TO  DO 
(Remedy) 


OH-58A  pi lot . . . failed 
to  perform  a  course  of 
action  required  by  TC 
1-28,  par.  5-28.  He 
failed  to  use  landing 
light  to  determine 
suitability  of  area 
for  precautionary 
landing. . . 


• • .because  required  equip¬ 
ment  is  improperly  designed. 
The  landing  light  produced 
glare  and  obstructed  vision 
of  the  pilot. 


...Because  of  inadequate 
unit  training.  Pilot  had 
not  received  sufficient 
training  in  execution  of 
emergency  procedures  at 
night  due  to  the  unit  being 
without  an  OH-58  IP  for  3 
months. 


DARCOM  redesign 
existing  equipment  to 
reduce  unacceptable 
glare  from  OH-58A 
fixed  landing  light 


Unit  Command  up¬ 
grade  unit  training 
to  maintain  aviator 
night  flight  pro- 
ficiency. . . 


METHOD 

The  3W  approach  was  used  to  investigate  96  major  accidents  in  FY  82.  These  accidents  produced  45 
fatal  and  107  non-fatal  injuries  and  a  cost  of  $63m  .  The  Army  Safety  Center  investigated  all  class 
A's  and  selected  class  B’s  and  C*s  totaling  74  accidents.  The  remaining  22  accidents  were  investigated 
by  field  accident  boards.  The  3W  information  from  reports  of  these  accidents  was  then  formatted  into 
lessons  learned  and  grouped  by  Aircrew  Training  Manual  Tasks. 

RESULTS 

Table  4  shows  the  number  and  cost  of  lessons  learned  by  type  flight  task  and  aircraft.  Utility, 
observation  and  attack  helicopters  accounted  for  821  of  the  lessons  learned  and  76Z  the  cost.  Human 
error  accounted  for  85X  of  the  lessons  learned  and  74Z  of  the  cost  while  materiel  failure  accounted  for 
only  15%  of  the  lessons  and  26%  of  the  cost. 
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This  represents  the  worst  annual  record  for  Army  aviation  safety  since  FY  73. 


TABLE  4  -  Number  and  cost  of  lessons  learned  by  aircrew 
training  manual  tasks  and  aircraft  type 


Aircrew  Training 
Manual  Tasks 

— 

Aircraft  Tvpes 

Totals 

Observation 
OH- 58  OH- 6 A 

Utility 

UH-1  UH-60 

Attack 
AH- IS 

Train ing 
TH-55 

Cargo 

CH-47 

Fixed  Wing 
0V-1D  T-42 

Flight  Planning 

i* 

2 

3 

1** 

4 

5 

$60*** 

$3,946 

$4,006 

Before-Flight 

1 

1 

2 

Inspection 

1 

1 

2 

$648 

$38 

$686 

Hovering 

4 

1 

2 

i 

8 

5 

4 

2 

i 

12 

$380 

$3,513 

$105 

$122 

$4,120 

Take  off 

2 

1 

1 

i 

5 

2 

l 

1 

i 

5 

$1,065 

$1,444 

$205 

$34 

$2,748 

Basic  Flight 

l 

■ 

1 

2 

1 

1 

2 

$194 

$3,190 

$3,384 

Approach  and 

1 

6 

2 

3 

mm 

Landing 

1 

9 

2 

3 

JJRJfH 

$248 

$3,535 

$2,480 

$4,798 

Emergency 

6 

2 

1 

■ 

1 

15 

16 

5 

6 

1 

■ 

1 

29 

$2,223 

$2,707 

$5,154 

$12 

$36 

$10,152 

Tactical  and 

1 

3 

4 

Special 

1 

6 

7 

$483 

$5,761 

$6,244 

Ground  Taxiing 

2 

1 

3 

2 

1 

3 

$122 

$48 

$170 

Materiel 

2 

8 

1 

1 

2 

14 

Failures 

2 

8 

1 

1 

2 

14 

$174 

$6,794 

$2,235 

$26 

§5,395 

$14,598 

Lessons  Learned 

18 

24 

11 

4 

6 

70 

Number  of 

Aircraft  Involved 

29 

38 

12 

4 

6 

7 

96 

Total  Cost 

$4,827 

$28,348 

$10,179 

$123 

$5,682 

$57,262 

♦Number  of  lessons  learned 
♦♦Number  of  aircraft  Involved 
♦♦♦Cost  multiplied  by  $1,000 


Human  error  in  two  types  of  tasks  accounted  for  almost  half  of  all  lessons  learned;  i.e.,  emergency 
tasks  (21% )  and  approach  and  landing  tasks  00%).  These  two  tasks  were  also  responsible  for  37%  of  all 
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Table  5  shows  the  distribution  of  the  system  inadequacies  causing  human  error  and  materiel 
failure  across  flight  tasks.  It  can  be  seen  that  Inadequate  supervision  and  inadequate  self-discipline 
account  for  most  of  the  system  inadequacies.  Examples  of  lessons  learned  are  appended. 


Table  5  -  Number  of  lessons  learned  by  aircrew  training 
manual  tasks  and  system  inadequacies 


System  Inadequacies 

Aircrew  Training 
Manual  Tasks 

Written 

Procedure 

Self 

Discipline 

Supervision 

Unit 

Trainina 

Design 

School 

Trainina 

QC 

MFR 

Maint 

Other 

Total 

Flight 

Planning 

4 

1 

5 

Before  Flight 
Inspection 

2 

2 

Tactical  and 
Special 

4 

3 

7 

Hovering 

i 

8 

1 

1 

1 

12 

Take  Off 

3 

-> 

1 

1 

5 

Basic  Flight 

2 

2 

Approach  and 
Landings 

11 

3 

2 

16 

Emergency 

4 

7 

9 

i 

7 

i 

29 

Ground  Taxiing 

2 

i 

3 

Materiel 

Failures 

1 

4 

2 

2 

6 

15 

Total 

5 

43 

18 

3 

11 

2 

2 

2 

10 

96 

DISCUSSION  AND  CONCLUSIONS 

Aviation  accidents  from  FY  82  were  investigated  and  analyzed  using  the  3H  approach.  This  enabled 
the  identification  of  lessons  learned  with  respect  to  cost,  type  aircraft,  flight  tasks,  cause  factors 
and  system  inadequacies  that  produced  the  human  error  and  materiel  failure  cause  factors. 

The  lessons  learned  identified  human  error  as  the  primary  cause  factor,  regardless  of  type  aircraft, 
and  these  errors  showed  up  mainly  in  emergency  or  landing  and  approach  tasks.  The  most  frequent  system 
inadequacies  leading  to  human  error  were  inadequate  self-discipline  and  Inadequate  supervision.  The 
unit  conaander  is  in  the  best  position  to  take  actions  that  will  correct  these  Inadequacies  within  the 
unit.  Therefore,  all  lessons  learned  from  FY  82  have  been  compiled  in  a  single  report  and  distributed 
to  commanders  of  aviation  units.  Additionally,  the  lessons  learned  report  has  been  provided  to  major 
commands  and  higher  staff  levels  for  actions  to  correct  system  problems  that  are  beyond  the  purview  of 
unit  commanders. 
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APPENDIX:  EXAMPLES  OP  LESSONS  LEARNED 
TOPIC:  TACTICAL  AND  SPECIAL  TASKS 

Lesson  Learned  #16:  Aviators  who  Intentionally  violate  written  guidelines  and  verbal  orders  governing 
requirements  of  low  level  flight  increase  the  probability  of  wire  strikes. 

Lesson  Cost:  Class  A  accidents:  UH-1(3);  OH-58 
Fatal  Injuries:  A 
Non-Fatal  Injuries:  15 
Cost:  $3,817,739 

Problem:  Because  of  excessive  self-motivation  or  Improper  motivation,  avlatots  intentionally  fly  their 
aircraft  at  low  level  altitudes  and  airspeeds  that  violate  oral  and  written  guidelines.  As  a  result, 
aviators  encounter  flight  problems  from  which  they  cannot  recover,  e.g.,  wires. 

Corrective  Actlon(s):  Unit  Commander  take  positive  command  action  to  Insure  aviators  understand  and 
comply  with  oral  and  written  guidelines  governing  low-level  flight  altitudes  and  airspeeds  and  that 
these  guidelines  are  not  violated  to  enhance  mission  accomplishment . 


TOPIC:  NORMAL  APPROACHES 

Lesson  Learned  #37:  Inadequate  self-discipline  of  aviators  adversely  affects  their  ability  to  make 
sound  decisions  regarding  by-the-book  flight  and  safe  aircraft  operations  during  approach. 

Lesson  Cost:  Class  A  accident:  AH-1S 
Class  C  accident:  TH-55A 
Non-Fatal  Injuries:  1 
Cost:  $1,600,990 

Problem  #1 :  PIC's  inadequate  self-discipline  (improper  attitude)  encouraged  pilot  to  fly  unautorized 
maneuvers  which  exceeded  the  pilot's  and  aircraft's  abilities. 

Corrective  Action(s):  Unit  Commander  take  positive  command  action  to  inform  personnel  of  problems 
encountered,  monitor  flight  activity  to  identify  improper  attitudes/behaviors  regarding  by-the-book  safe 
performance,  and  take  effective  enforcement  actions  to  control  problems  identified. 

Problem  #2:  Pilot  was  in  a  hurry  to  return  to  the  heliport  because  of  deteriorating  weather  conditions.  In 
his  haste  the  pilot  reduced  the  throttle  below  necessary  RPM  (in  contravention  of  TM  55-1520-238-10, 
para  8-43)  causing  him  to  land  tall  low. 

Corrective  Actlon(s):  Recommend  Unit  Commander  inform  personnel  of  problems  and  remedies  associated 
with  these  accidents.  Include  a  discussion  of  the  adverse  affect  "haste"  can  have  on  job  performance. 


TOPIC:  FLIGHT  PLANNING  TASKS 

Lesson  Learned  #13:  A  Unit  Commander  who  fails  to  establish  a  crew  rest  policy  in  accordance  with  Table 
5-1,  AR  95-1  lncreasesthe  probability  of  having  fatigued  aviators  making  critical  errors. 

Lesson  Cost:  Class  A  accident:  UH-l 
Non-Fatal  Injuries:  2 
Cost:  $927,634 


Problem:  The  lack  of  unit  guidance  regarding  crew  rest  requirements  for  aviators  promotes  abuses  in  the 
assignment  of  work  tasks  for  aviators,  e.g.,  aviator  continuing  flight  duties  after  having  only  nine 
hours  of  interrupted  sleep  in  forty-eight  hours. 

Corrective  Actlon(a):  Unit  Commander  take  positive  comnand  action  to  insure  crew  rest  polices  are 
established.  AR  95-1,  Table  5-1,  may  be  used  as  a  guide  in  this  effort. 


TOPIC:  EMERGENCY  TASKS 

Lesson  Learned  #2:  Failure  to  Insure  TM  55-1520-228-10  (OH-58)  provides  adequate  instructions  for 
describing  tall  rotor  malfunctions  and  the  correct  emergency  procedures  for  coping  with  them  increases  the 
probability  of  an  aviator  improperly  handling  this  type  of  emergency. 

Lesson  Cost :  Class  A  accidents:  OH-58(2) 

Fatal  Injuries:  1 
Non-Fatal  Injuries:  3 
Cost:  $631,595 

Problem:  Tall  rotor  malfunctions  and  loss  of  tall  rotor  effectiveness  has  become  a  concern  in  OH-58 
aircraft.  However,  about  two  pages  of  TM  55-1510-228-10  are  delegated  to  a  description  of  tail  rotor 
malfunctions  and  emergency  procedures.  The  terminology  used  is  vague  and  the  procedures  described 
conflict  from  one  paragraph  to  the  next  such  that  the  reader  is  confused  as  to  the  required  corrective 
actlon(s) . 

Corrective  Actlon(s):  DARCOM  revise  procedures  in  TM  55-1520-228-10B,  Chapter  9,  concerning  tail  rotor 
malfunctions  such  that  corrective  actions  for  each  set  of  circumstances  are  expressed  explicitly  and 
without  conflict. 
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SUMMARY \ 

^  Some  problems  that  have  been  encountered  in  the  recovery  of  information  from 
flight  recorders  for  the  investigation  of  aircraft  mishaps  are  described.  Techniques 
for  rapid  dissemination  of  the  information  to  investigators  are  illustrated.  Future 
developments  in  the  design  of  voice  and  data  recorders  are  discussed.. 

1.  INTRODUCTION 

Flight  data  recorders  and  cockpit  voice  recorders  are  now  well  established  in 
the  scenario  of  aircraft  incident  and  accident  investigation.  Their  unparalleled 
ability  to  provide  detailed  information  on  the  events  leading  up  to  a  mishap  can  rapidly 
indicate  the  areas  in  which  the  investigators  should  focus  their  activities. 

In  Canada,  our  experience  with  flight  recorders  has  been  confined  mainly  to 
transport  aircraft.  Ten  years  ago,  we  set  up  a  Flight  Recorder  Playback  Centre  at  the 
Flight  Research  Laboratory  of  the  National  Aeronautical  Establishment  to  recover  infor¬ 
mation  from  all  voice  and  data  recorders  fitted  to  Canadian  civil  and  military  aircraft. 
The  Centre  is  funded  jointly  by  the  National  Research  Council,  Transport  Canada,  and  the 
Department  of  National  Defence. 

The  Centre  is  responsible  for  playback  and  analysis  of  information  from  all 
accidents  and  incidents  as  requested  by  the  investigating  authorities.  Routine  service¬ 
ability  checks  are  also  made  of  all  the  military  recorder  systems.  Incident  investiga¬ 
tions  have  also  been  undertaken  upon  request  from  Canadian  manufacturers,  air  carriers 
and  the  Canadian  Air  Line  Pilots  Association. 

The  centre  is  required  to  process  fourteen  different  basic  recorders  and  a 
number  of  minor  variants.  The  civil  systems  involve  separate  voice  and  data  recorders 
armoured  and  insulated  to  protect  them  in  the  crash  environment.  The  voice  recorders 
are  designed  to  retain  the  last  30  minutes  of  information  and  the  data  recorders  the 
last  15  to  25  hours.  The  majority  of  the  military  systems  utilise  a  light-weight  com¬ 
bined  voice  and  data  recorder  housed  in  a  deployable  radio  beacon  otherwise  known  as  a 
crash  position  indicator.  The  recorder  retains  the  last  30  minutes  of  both  voice  and 
data. 

A  description  of  some  of  the  capabilities  and  activities  of  the  Centre  was 
given  at  the  Symposium  on  "Aircraft  Operational  Experience  and  its  Impact  on  Safety  & 
Survivability",  held  by  the  Flight  Mechanics  Panel  at  Sandefjord,  Norway  in  1976  (Ref.l). 
In  this  paper,  I  will  attempt  to  summarise  some  of  our  subsequent  efforts  and  comment  on 
the  future  development  of  recording  systems. 

2 .  DATA  RECOVERY 

As  described  in  Reference  1,  from  the  outset  our  playback  facilities  were  de¬ 
signed  with  emphasis  on  the  recovery  of  information  from  damaged  tapes  and  poor  quality 
recordings.  Our  subsequent  experiences,  particularly  with  the  first  generation  of 
digital  recording  systems,  proved  this  decision  to  be  a  wise  one. 

Failure  monitoring  in  these  systems  has  a  very  limited  capability  indicating 
only  whether  the  recorder  itself  is  operational  as  opposed  to  checking  the  contents  of 
the  serial  digital  signal  being  recorded.  Major  defects  in  the  signal  have  often  re¬ 
mained  undetected  until  a  mishap  has  occurred.  Such  defects  have  included  incorrect 
synchronisation  codes,  frozen  bits  in  the  analog-to-digital  conversion,  incorrect  multi¬ 
plexing  of  the  parameters,  and  erroneous  values  due  to  erratic  D.C.  power  supplies. 
Fortunately,  in  many  cases,  detailed  study  of  the  serial  digital  signal  has  permitted 
recovery  of  some,  if  not  all,  of  the  important  information,  though  the  task  has  sometimes 
been  formidable. 

The  accident  environment  can  involve  abnormal  levels  of  vibration  and  shock 
loading  that  affect  the  quality  of  the  recorded  signal  through  the  mechanical  limitations 
of  the  tape  transport  mechanism. 

To  assist  in  recovering  information  under  these  difficult  conditions,  we  have 
developed  hardware  to  cope  with  variable  data  rates.  We  also  have  an  editing  routine 
that  allows  us  to  examine  the  recovered  serial  digital  signal  for  loss  in  bit  synchroni¬ 
sation.  We  can  then  shift  the  bit  sequence  to  re-synchronise  the  data.  By  examining 
high  speed  oscillograph  records  of  the  signal,  we  are  also  able  to  retrieve  short  periods 
of  data  that  are  too  badly  distorted  for  the  playback  system  to  decode  them.  These  also 
may  be  edited  into  the  data  stream. 


In  our  limited  experience  with  catastrophic  accidents,  we  have  had  to  contend 
with  recorders  that  have  been  immersed  in  sea-water,  tapes  that  have  been  broken  upon 
impact  and  last,  but  not  least,  fire  damage. 

Sea-water  presents  no  major  difficulty  provided  that  the  recording  tape  can  be 
rinsed  in  fresh  water  immediately  on  removal  from  the  sea-water  to  prevent  salt  deposits. 
We  have  had  one  case  involving  a  metal  tape  where  this  was  not  done  and  experienced  con¬ 
siderable  loss  of  data  until  we  finally  managed  to  remove  the  resulting  deposits. 

We  have  not  encountered  any  armoured  recorders  in  which  the  tape  transport  has 
suffered  impact  damage,  apart  from  one  metal  tape  that  fractured  in  two  places.  On  the 
other  hand,  none  of  the  accidents  involved  a  high  speed  ground  impact.  The  metal  tape 
fractures  were  probably  attributable  to  large  angular  accelerations  associated  with  high 
rotary  inertia  of  the  tape  on  the  reels. 

We  have  lost  three  armoured  and  insulated  recorders  due  to  fire  damage  in  two 
separate  accidents.  These  units  are  required  to  be  installed  near  the  tail  of  the  air¬ 
craft  to  minimise  impact  damage  and  are  most  frequently  placed  in  the  rear  of  the  pres¬ 
sure  cabin  for  ease  of  access.  Whilst  fireproofing  specifications  ensure  that  the  units 
can  withstand  the  temperatures  of  ensuing  fires,  prolonged  immersion. in  the  hot  debris 
can  result  in  over-heating  of  the  recording  medium,  though  there  have  been  surprisingly 
few  cases  in  which  this  has  happened. 

One  of  these  accidents  occurred  to  a  twin  engined  jet  transport  when  control 
was  lost  during  an  overshoot  necessitated  by  the  presence  of  a  snowclearing  vehicle  on 
the  runway.  Although  the  crash  site  was  within  the  confines  of  the  airfield,  deep  snow 
prevented  the  only  available  fire  vehicle  from  reaching  the  site  promptly.  The  damaged 
flight  recorders  were  not  identified  and  removed  from  the  wreckage  until  20  hours  later. 
When  the  charred  remains  arrived  at  the  Playback  Centre,  we  initially  declared  them  both 
to  be  totally  destroyed. 

Figure  1  illustrates  the  condition  of  the  flight  data  recorder.  Aside  from  the 
metal  components,  only  the  remnants  of  the  tape  itself  are  evident,  most  of  them  being 
bonded  to  the  metal  cover.  Figure  2  shows  a  close-up  of  the  most  important  segments  still 
on  the  tape  transport  with  the  recording  heads  and  capstan  on  the  right. 

In  the  laboratory,  we  frequently  use  Soundcraft  Magnasee  to  check  on  tape 
alignment.  This  consists  of  fine  magnetic  particles  in  suspension  in  alcohol.  When  we 
carefully  applied  this  product  to  the  charred  tape,  we  found  that  the  magnetic  pattern 
was  still  there.  We  estimated  that  the  tape  transport  had  reached  a  temperature  of  450°C. 

With  a  packing  density  of  only  151  bits/cm  (384  bits/inch) ,  the  bit  pattern 
made  visible  by  the  Magnasee  (Fig.  3)  could  be  read  with  a  conventional  microscope, 
though  the  fragility  of  the  tape  and  numerous  deposits  on  it  made  this  a  difficult  and 
challenging  task.  We  found  that  data  on  four  of  the  eight  tracks  could  not  be  deciphered 
due  to  an  unidentified  recording  fault  but  that  the  accident  information  was  fortunately 
on  the  good  track  that  was  nearest  to  the  centre  of  the  tape.  This  allowed  us  to  read 
the  data  in  spite  of  severe  curling  of  the  tape  edges.  Over  a  period  of  three  weeks,  we 
finally  recovered  5000  bits  of  critical  information  covering  three  important  6  second 
periods  immediately  prior  to  the  accident. 

From  a  study  of  the  wreckage,  it  was  evident  that,  if  the  recorders  had  been 
installed  in  the  tail-cone  aft  of  the  pressure  bulkhead,  very  little  deunage  would  have 
ensued  and  the  speed  of  the  data  recovery  would  have  been  measured  in  seconds  rather  than 
weeks. 

Analysis  of  the  recovered  data  also  revealed  a  major  fault  in  a  synchro  con¬ 
verter  that  affected  seven  of  the  parameters  being  monitored,  but  a  detailed  study  per¬ 
mitted  reasonable  corrections  to  be  made  to  most  of  the  measurements.  The  information 
that  we  finally  obtained  proved  invaluable  to  the  investigation  and  more  than  justified 
the  efforts  expended. 

Subsequent  research  has  indicated  that,  with  care,  the  Magnasee  technique 
might  be  used  to  recover  data  from  damaged  tapes  with  packing  densities  up  to  400  bits/cm 
(1000  bits/in).  Unfortunately,  more  recent  designs  utilise  packing  densities  as  high  as 
817  bits/cm  (2076  bits/in).  For  these  tapes,  we  decided  to  investigate  the  use  of  a 
scanning  electron  microscope.  Preliminary  experiments  have  indicated  that  the  data  can 
be  made  visible  with  this  technique  (Fig.  4).  For  conventional  magnetic  tapes,  excessive 
heating  of  the  organic  material  by  the  electron  beam  can  be  avoided  by  use  of  low  beam 
voltages  and  gold  coating  of  the  specimen  that  also  prevents  charge  build-up  on  the  tape 
surface.  The  one  metal  tape  currently  in  use  does  not,  of  course,  suffer  from  this 
problem. 

In  the  case  of  our  military  deployable  systems,  the  light  weight  beacon  that 
contains  the  recorder  has  been  designed  to  fly  in  a  curved  path  after  release  to  land 
outside  the  area  of  severe  fire  damage.  There  still  remains  a  slight  possibility  that 
the  tape  may  be  damaged  mechanically  or  by  fire.  Again,  in  this  case,  the  packing 
density  of  the  data  on  the  tape  is  extremely  low,  partly  as  a  result  of  the  relatively 
high  tape  speed  necessitated  by  the  audio  channels,  and  the  Magnasee  technique  should  be 
adequate . 
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3.  DATA  PRESENTATION 

The  other  area  in  which  we  have  made  considerable  progress  is  in  the  rapid 
presentation  of  the  information  in  a  meaningful  form.  The  techniques  that  we  have 
developed  include  plotting  time  histories  of  selected  parameters  in  engineering  units 
against  appropriate  time  scales,  reconstruction  of  perspective  views  of  the  aircraft  as 
it  moves  along  the  flight  path  both  in  stored  and  real-time  formats,  and  simulation  of 
the  aircraft  instrument  display  and  pilot's  control  inputs  utilising  the  recorded  data. 
These  techniques  are  demonstrated  in  a  short  movie  to  be  shown  during  the  presentation. 

We  endeavour  to  maintain  accurate  directories  specifying  the  parameters  being 
monitored,  their  location  in  the  appropriate  serial  digital  format,  and  the  calibrations 
required  to  convert  the  recorded  digital  numbers  into  engineering  units  for  all  Canadian 
civil  and  military  aircraft  equipped  with  recorders. 

In  any  particular  investigation,  the  calibrations  may  need  modification 
depending  on  the  availability  of  suitable  corrections.  When  we  convert  the  data  into 
engineering  units,  we  therefore  store  the  directory  used  for  the  conversion  ahead  of  the 
data  stream.  Selected  parameters  may  then  be  printed  out  using  a  high  speed  line  printer 
or  plotted  as  time  histories  over  the  required  time  interval  using  a  Tektronix  4014 
computer  graphics  terminal.  The  parameter  titles  and  units  are  picked  up  from  the 
directory  preceding  the  data.  A  Tektronix  Hard  Copy  Unit  is  used  to  rapidly  produce 
page-sized  hard  copies  of  the  time  histories  (Fig.  5). 

As  far  as  the  aircraft  motion  is  concerned,  print  outs  or  plotted  time 
histories  of  the  altitude,  airspeed,  pitch,  roll  and  yaw  angles  are  not  a  very  effective 
means  of  conveying  a  mental  picture  of  the  gyrations  of  the  aircraft.  We  therefore 
utilise  the  recorded  data  to  determine  true  air  speed  and,  with  the  addition  of  the  best 
estimates  of  the  wind  variations,  compute  the  flight  path  coordinates.  These  are  then 
combined  with  the  recorded  attitudes  to  generate  the  perspective  views  of  symbolic 
aircraft  drawn  along  the  flight  path  as  illustrated  in  Figure  6.  The  motion  may  be 
viewed  from  any  fixed  position  in  space.  The  one  approximation  that  we  normally  have  to 
make  is  to  assume  zero  sideslip  as  this  is  not  directly  monitored  by  any  of  the  data 
recorders.  If  sideslip  could  be  estimated,  it  could  of  course  be  incorporated  into  the 
display. 


On  aircraft  equipped  with  inertial  navigation  systems,  accurate  flight  path 
information  is  directly  available.  In  Canada,  until  the  recent  introduction  of  the 
Boeing  767  into  service  with  Air  Canada,  the  required  parameters  have  not  been  recorded. 
We  have  not  yet  utilised  this  source  of  information. 

An  alternative  presentation  that  we  have  developed  has  the  symbolic  aircraft 
flying  across  the  screen  of  the  computer  graphics  display  in  real  time.  We  draw  the 
reference  grid  in  a  horizontal  plane  (usually  the  ground  plane)  as  in  Figure  6  and  have 
found  it  advantageous  to  include  a  shadow  of  the  centre  of  gravity  on  the  plane  vertical¬ 
ly  below  the  aircraft.  Where  appropriate,  cockpit  voice  recordings  may  be  replayed  in 
synchronism  with  the  display. 

This  presentation  can  be  generated  on  the  Tektronix  4014  that  is  basically  a 
storage  CRT  by  using  a  "write-thru"  mode.  However,  the  display  needs  to  be  viewed  in  a 
darkened  room.  We  have  therefore  acquired  a  Hewlett  Packard  1351A  Graphics  Generator 
with  a  vector  refresh  display  that  produces  a  brighter  image.  The  real  time  motion  can 
then  be  recorded  on  film  or  video-tape  together  with  the  synchronised  audio  for  dispatch 
to  the  investigators. 

In  search  for  more  meaningful  ways  of  presenting  the  wide  range  of  recorded 
data,  we  originated  the  CRT  re-creation  of  the  flight  instruments  and  controls  as  a  poor 
man's  substitute  for  feeding  the  recorder  data  into  a  flight  simulator.  One  of  our  early 
efforts  was  presented  in  Reference  1  back  in  1976. 

We  originally  used  the  Tektronix  4014  displays  with  instrument  scales  and 
titles  being  written  in  the  normal  storage  mode  and  the  pointers  or  digital  displays 
using  the  "write-thru"  mode.  More  recently,  the  Hewlett-Packard  display  has  been  used  to 
produce  the  brighter  images  for  film  or  video-tape.  Sample  displays  are  illustrated  in 
Figures  7  and  8 . 

As  with  the  real-time  display  of  the  aircraft  motion,  the  cockpit  voice  record¬ 
ings  can  be  replayed  in  synchronism  with  the  display  to  provide  a  more  realistic  recon¬ 
struction  of  the  situation  on  the  flight  deck.  The  display  can  be  generated  using  either 
the  original  serial  digital  signal  from  the  flight  recorder  or  the  subsequent  computer 
tape  format  of  the  same  information. 

In  the  case  of  our  military  deployable  systems,  the  recorder  may  be  plugged 
directly  into  the  playback  system  to  immediately  generate  the  combined  audio-visual  dis¬ 
play.  In  a  recent  fatal  accident  that  occurred  to  a  CC-130  aircraft  during  a  LAPES 
exercise,  we  delivered  the  preliminary  information  to  the  investigators  in  the  field  in 
the  form  of  a  video-cassette  of  this  display  within  hours  of  receiving  the  recorder  at 
the  Playback  Centre.  It  is  an  understatement  to  say  that  this  was  greatly  appreciated. 

With  the  civil  systems,  we  normally  re-record  the  serial  digital  signal  onto 
one  track  of  an  audio  tape  and  then  record  the  carefully  synchronised  audio  information 
onto  the  remaining  tracks  as  on  the  military  tapes.  In  the  event  that  the  recovered  data 


requires  editing,  we  have  a  computer  interface  that  allows  us  to  re-generate  the  serial 
digital  format  from  the  edited  data  for  synchronisation  with  the  audio  recordings . 

The  software  required  to  generate  these  displays  has  been  prepared  for  eighteen 
different  aircraft/recording  system  combinations.  It  is  flexible  enough  for  rapid 
changes  to  be  made  to  the  display  if  this  is  desirable. 

The  displays  use  the  sampled  digital  data  directly  and  therefore  show  step 
changes  in  value  at  the  sampling  rate  of  the  parameter  involved.  Although  this  feature 
is  unrealistic,  it  does  reflect  the  limitations  of  the  information.  It  may  also  partial¬ 
ly  account  for  the  one  criticism  of  the  displays  that  we  have  received  from  pilots, 
notably  the  lack  of  vertical  speed  indication.  Until  the  introduction  of  the  Boeing  767, 
this  has  not  been  monitored  as  a  separate  data  parameter  on  Canadian  aircraft. 

It  is  gratifying  to  know  that  this  display  technique  has  since  been  adopted  by 
other  agencies  and  manufacturers. 

4.  VOICE  RECORDING  SYSTEMS 

Current  civil  cockpit  voice  recorders  retain  the  last  30  minutes  of  four  audio 
channels  including  pilot,  co-pilot,  and  third  crew  member  channels  and  one  for  a  cockpit 
area  microphone.  When  there  are  only  two  crew  members,  the  remaining  channel  may  be  used 
for  recording  passenger  announcements.  The  crews'  channels  include  all  signals  from  both 
their  microphones  and  headphones. 

On  many  aircraft  with  a  relatively  quiet  cockpit,  conversation  between  the 
pilots  does  not  necessitate  use  of  their  intercommunication  system.  In  the  event  of  a 
mishap,  this  conversation  is  only  recorded  on  the  cockpit  area  microphone  channel.  The 
level  of  background  noise  is,  in  many  cases,  sufficiently  high  to  make  the  detection  of 
some  conversation  difficult  or  impossible  in  spite  of  the  use  of  advanced  filtering 
techniques. 

In  the  United  Kingdom,  where  boom  microphones  are  standard  equipment,  this 
problem  has  been  largely  overcome  by  requiring  these  microphones  to  be  live  to  the  cor¬ 
responding  pilot's  channel  at  all  times.  As  long  as  the  crew  members  wear  their  head 
sets,  high  quality  recordings  of  their  speech  are  ensured  and  their  seating  positions 
are  clearly  indicated. 

Unfortunately,  on  many  civil  transports  in  North  America,  hand-held  microphones 
are  still  standard  equipment.  The  live  microphone  technique  is  obviously  irrelevant  when 
they  are  in  use.  However,  the  aircraft  normally  have  provision  for  the  use  of  boom 
microphones  as  a  crew  option.  With  our  limited  experience,  we  would  strongly  recommend 
that  these  inputs  be  designed  to  ensure  that  they  are  live  to  the  recorder  at  all  times. 

The  use  of  the  hot  boom  microphones  does  not  eliminate  the  requirement  for  the 
cockpit  area  microphone  as  we  are  often  interested  in  the  background  noises  themselves. 

With  only  the  last  30  minutes  of  recording  being  retained,  there  have  been  many 
incidents  or  minor  accidents  following  which  the  recorder  has  continued  to  operate  for 
long  enough  to  erase  all  useful  information.  To  alleviate  this  problem,  proposed  changes 
to  the  ICAO  flight  recorder  requirements  include  extension  of  the  retention  time  to  60 
minutes  for  transport  aircraft  over  27,000  kg.  Such  an  extension  has  been  technically 
feasible  for  a  long  time,  but  has  been  opposed  by  many  pilots’  associations  who  are  con¬ 
cerned  over  mis-use  of  the  information  so  obtained. 

In  some  countries,  these  concerns  have  been  well  justified.  From  experience  in 
Canada,  it  has  been  evident  that  protection  from  mis-use  can  only  be  guaranteed  if  appro¬ 
priate  legislation  is  enacted  by  the  national  government.  The  current  trend  towards 
freedom  of  public  access  to  government  retained  information  makes  this  imperative.  Con¬ 
tinuous  detailed  recording  of  the  audio  environment  on  the  flight  deck  during  accidents 
is  a  unique  form  of  monitoring  of  human  behaviour  under  extreme  stress  and  certainly 
justifies  some  special  consideration.  It  should  be  noted  that,  in  the  present  day  envi¬ 
ronment,  even  military  aircraft  operations  are  not  necessarily  isolated  from  these 
problems . 


Some  pilots  associations  have  objected  to  the  use  of  cockpit  voice  recordings 
for  the  investigation  of  incidents  as  opposed  to  accidents,  though  the  information  can 
still  be  of  great  value.  It  is  hoped  that  these  objections  will  be  withdrawn  if  suitable 
legislation  is  enacted  to  avoid  its  mis-use. 

The  advantages  of  accurate  voice/data  synchronisation  particularly  ih  genera¬ 
ting  combined  audio-visual  presentations  of  the  recorded  information  have  already  been 
discussed.  The  current  civil  requirement  to  include  keying  of  all  radio  transmissions  on 
the  data  recorder  is  not  considered  adequate  as  there  may  be  no  transmissions  close  to 
the  time  of  the  incident  or  accident.  We  have  had  the  benefit  of  combined  voice/data  re¬ 
cording  in  accident  investigations  on  both  military  and  civil  aircraft  transports  and 
reconmend  that  the  serial  digital  data  signal  should  be  recorded  on  one  channel  of  the 
voice  recorder  as  well  as  on  the  longer  duration  data  recorder. 

5.  DATA  RECORDING  SYSTEMS 


The  design  of  the  data  recording  systems  for  incident  and  accident  investigation 


involves  a  multitude  of  compromises  that  cannot  possibly  be  covered  in  one  short  review, 
but  there  are  a  few  aspects  on  which  I  would  like  to  comment. 

Due  to  the  need  to  monitor  many  facets  of  the  aircraft  operation,  the  number  of 
parameters  being  recorded  is  increasing  as  the  aircraft  become  more  complex.  With  the 
generally  accepted  requirement  to  retain  the  last  25  hours  of  data,  the  sampling  rates 
that  result  are  substantially  lower  than  those  normally  used  in  flight  test  work  and  are 
often  inadequate  particularly  in  high  speed  mishaps.  It  has  been  frustrating  to  encoun¬ 
ter  many  recording  systems  in  which  the  recording  capacity  has  not  been  fully  utilised, 
and  where,  for  the  cost  of  a  few  extra  wiring  connections,  the  sampling  rates  of  the  more 
critical  parameters  could  have  been  increased.  The  fact  that  the  requirements  specify 
only  the  minimum  acceptable  sampling  rate  has  obviously  not  been  adequately  emphasised. 

By  the  same  token,  in  early  designs  in  which  special  transducers  have  been  in¬ 
stalled  for  the  recorder  system,  the  impracticability  of  frequent  calibrations  of  para¬ 
meters  in  routine  operations  has  resulted  in  the  acceptance  of  much  lower  accuracies  than 
would  normally  be  specified  for  flight  test  work.  Fortunately,  the  resolution  of  many  of 
the  parameters  has  been  substantially  better  than  the  accuracy  and,  in  the  cases  where 
post-incident  calibration  has  been  possible,  acceptable  data  has  been  derived. 

In  later  designs,  greater  use  has  been  made  of  existing  information  sources  in 
the  aircraft  such  as  the  digital  data  bus.  The  accuracy  and  reliability  of  these  sources 
are  normally  much  higher  than  those  of  specially  installed  transducers  as  they  are  essen-  i 

tial  for  operation  of  the  aircraft.  The  use  of  these  sources  is  therefore  preferred  pro¬ 
vided  that  connection  to  the  recorder  system  does  not  significantly  degrade  the  reliabil¬ 
ity  of  the  source.  j 
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Investigators  have  justified  retention  of  the  last  25  hours  of  data  as  a  means  j 

of  ensuring  that  data  from  at  least  one  flight  preceding  a  mishap  is  available  for  compar¬ 
ison  with  that  obtained  during  the  mishap  as  a  check  on  erroneous  data.  This  was  certain¬ 
ly  the  case  in  an  aborted  take-off  accident  for  which  we  were  able  to  demonstrate  from 
previous  take-offs  and  landings  that  the  special  airspeed  transducer  for  the  recording 
system  was  in  error  by  about  20  knots.  When  the  recorder  system  is  coupled  to  the  more 
reliable  and  more  accurate  aircraft  digital  data  bus,  one  wonders  whether  this  argument 
for  such  a  long  recording  period  is  still  justified.  The  current  Canadian  civil  require¬ 
ment  of  110%  of  the  maximum  flight  duration  might  be  more  appropriate  and  would  permit, 
for  example,  a  doubling  of  the  sample  rate  of  all  parameters  for  the  same  recorder  memory 
capacity. 


As  mentioned  earlier,  over  the  years  we  have  encountered  a  number  of  problems 
with  the  recovery  of  information  from  data  recorders.  These  are  mostly  associated  with 
mechanical  imperfections  e.g.  tape  mis-alignment,  wow  and  flutter,  particularly  under 
abnormal  conditions  involving  high  levels  of  vibration.  These  imperfections  are  being 
reduced  with  improved  design. 

An  alternative  approach  now  being  offered  is  the  replacement  of  these  units  with 
solid  state  memories.  These  have  the  potential  to  provide  substantial  increases  in  reli¬ 
ability  and  an  associated  reduction  in  maintenance  costs  that  look  extremely  attractive. 
Crash  survivable  modules  have  been  demonstrated. 

The  major  limitation  of  the  units  proposed  so  far  is  the  restriction  in  memory 
size  to  only  a  small  proportion  of  that  currently  provided  by  tape  recorders.  This  is 
necessitated  by  economic  constraints  that  hopefully  will  be  eased  as  the  technology  devel¬ 
ops.  To  minimise  the  effect  of  this  limitation,  it  is  proposed  that  data  compression  be 
used. 


In  routine  flights,  there  are  long  periods  when  most  of  the  parameters  being 
monitored  are  almost  constant.  Data  compression  can  be  achieved  by  recording  samples  only 
when  there  is  a  significant  change  in  value.  This  can  greatly  reduce  the  amount  of  infor¬ 
mation  to  be  recorded.  The  reduction  is,  of  course,  tempered  by  the  necessity  of  label¬ 
ling  each  measurement  with  its  associated  time. 

Various  algorithms  have  been  proposed  in  order  to  decide  when  values  should  be 
recorded.  My  one  concern  is  that  they  will  all  reduce  the  resolution  of  the  measurements, 
sometimes  to  an  undesirable  extent,  in  order  to  achieve  worthwhile  compression. 

Unfortunately,  most  recorder  requirements  do  not  specify  any  required  resolu¬ 
tion,  and  it  has  been  assumed  to  be  synonymous  with  the  specified  accuracy.  Again,  only 
the  U.K.  civil  requirements  have  covered  this  aspect,  specifying  that  the  resolution  shall 
be  five  tiroes  better  than  the  long-term  accuracy.  This  will  seriously  restrict  the  degree 
of  data  compression  that  they  can  accept. 

The  solid  state  memory  does  have  the  advantage  that  it  is  more  amenable  to  the 
storage  of  pre-selected  sequences  and  events  as  opposed  to  continuous  data.  The  last  few 
minutes  of  data  may  be  stored  in  uncompressed  form  or  earlier  events  such  as  take-off, 
landings,  or  in-flight  incidents  retained.  This  capability  can  also  partially  offset  the 
restrictions  resulting  from  the  limited  memory  size. 

As  regards  the  crash  survivability,  if  the  same  level  of  protection  is  provided 
as  for  current  recorders,  we  can  anticipate  that  a  few  units  will  be  damaged  or  destroyed. 
One  would  like  to  know  whether  slight  damage  is  likely  to  cause  total  loss  of  all  infor¬ 
mation  or  whether  partial  data  recovery  might  still  be  possible  as  in  the  case  of  our 
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fire-damaged  tape. 

At  present,  it  would  appear  that  the  solid  state  memory  is  best  suited  to  air¬ 
craft  with  relatively  low  endurance  such  as  helicopters  and  smaller  military  aircraft, 
though  as  the  technology  progresses  it  is  conceivable  that  they  may  eventually  replace 
all  tape  recorder  systems, 

6 . 0  CONCLUSIONS 

The  major  contribution  that  flight  recorders  can  make  to  the  promotion  of  avia¬ 
tion  safety  has  been  well  established.  We  would  therefore  like  to  see  appropriate  de¬ 
signs  installed  in  a  much  wider  range  of  aircraft  types. 

Apart  from  the  immeasurable  life-saving  aspect  of  this  contribution,  the  high 
replacement  costs  of  modern  aircraft  can  easily  justify  the  expenditure  necessary  to 
install  and  maintain  the  recorder  systems.  This  is  particularly  true  on  aircraft  that 
have  a  digital  data  bus  containing  much  of  the  required  information. 

We  would  also  like  to  see  a  greater  input  from  flight  mechanics  specialists 
into  the  detailed  design  of  these  systems  to  ensure  that  the  information  that  they  pro¬ 
vide  is  adequate  for  the  investigation  of  a  wide  spectrum  of  possible  incidents  Or 
accidents . 
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Figure  X.  Fire  Damaged  Data  Recorder 


Figure  2.  Charred  Remnants  of  Data  Tape 


Figure  3.  Digital  Magnetic  Patterns  on  Charred  Tape 


Figure  4 .  Digital  Data  from  Scanning  Electron  Microscope 


Figure  6.  Presentation  of  Aircraft  Motion 


Figure  7.  Lockheed  C-I30  Instrument  and  Control  Display 
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Figure  8.  Lockheed  L-1101  Instrument  and  Control  Display 
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SUMMARY 


'he  idea  of  operational  fliqht  data  recording  started  with  the  continuous  recording  of  just 
wo  parameters  velocity  V  and  normal  acceleration  q.  The  value  of  information  gained  from 
hese  simple  recorders  encouraqed  improved  recorders  and  their  development  is  traced  up  to 
he  hiqh  capacity  digital  recorders  available  today.  The  data  recording  programme  operated 
ointly  by  the  CAA  and  the  participating  airlines  has  grown  considerably  over  the  20  years 
'f  its  existence.  Its  present  organisation  and  activities  are  described,  and  a  number  of 
xamples  of  the  analyses  performed  on  the  data  are  given  to  illustrate  the  wide  range  of 
reas  in  which  the  data  is  useful. 
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.  I ntroduct ion 

he  safety  of  an  aeroplane  depends,  amongst  other  things,  on  its  beinq  operated  within  a 

•reset  ibed  set  of  limitations.  There  are  speeds  above  which  it  should  not  be  flown  ar.d 
speeds  below  which  it  should  not  be  flown,  there  are  strenqth  limitations  which  impose  on 
the  pilot  a  maximum  manoeuvre  'q*,  and  which  define  the  maximum  velocity  of  gust  through 
which  the  aeroplane  can  fly  without  structural  damage.  To  exceed  any  of  these  limitations 
represents  a  hazard.  A  hazard  can  also  exist  in  other  situations  such  as  the  achievement 

of  excessive  bank  angle  or  descent  rate  close  to  the  ground.  We  need  to  know  at  what 

level  of  probability  these  hazardous  situations  exist,  and  at  what  level  of  probability 
they  may  become  extreme  and  cause,  or  contribute  to  an  accident.  It  is  a  little 
surprising,  therefore,  that  the  practise  of  making  measurements  of  the  operational 
performance  and  behaviour  of  aeroplanes  took  so  long  to  arrive,  and  that  it  is  even  now 
so  limited  in  application.  It  is  surprising  because  the  design  considerations  which 
determine  the  strength  and  handling  characteristics  of  an  aeroplane  are  in  many  cases 
based  on  assumption,  and  if  the  aeroplane  is  to  attain  an  acceptable  level  of  safety  and 
yet  retain  overall  economy  then  these  assumptions  need  to  be  verified.  If  they  are  too 
severe  then  the  aeroplanes  economy  suffers,  and  if  they  are  not  severe  enough  then  safety 

may  suffer.  It  is  true  that  many  years  of  experience  and  satisfactory  safety  records 

have  tended  to  justify  some  of  these  assumptions,  at  least  to  the  extent  that  safety  has 
not  suffered. 

This  paper  describes  a  programme  of  operational  fliqht  recording  on  civil  aeroplanes 
which  has  been  running  in  the  UK  for  over  20  years,  and  is  currently  collecting  data  from 
about  170,000  hours  of  flying  per  annum  on  7  different  types  of  aeroplane.  We  call  it 
the  Civil  Aircraft  Airworthiness  Data  Recording  Programme  (CAADRP ) . 

The  principal  objective,  in  a  word,  is  safety.  It  is  common  experience  that  in  nearly 
all  accidents  the  investigation  reveals  that  there  were  a  number  of  contributory  causes 
which  individually  would  not  have  led  to  the  accident.  A  poet  who  had  never  seen  an 
aeroplane  once  said: 

Large  streams  from  little  fountains  flow 

Tall  oaks  from  little  acorns  grow. 

It  is  the  little  acorns  we  are  looking  for  to  try  to  ensure  that  they  do  not  grow  into 
tall  oaks . 

2 .  Origins  and  History  of  CAADRP 

The  military  aeroplanes  which  were  in  service  at  the  beginning  of  the  war  in  1919  had  been 
designed  to  relatively  low  manoeuvre  envelopes,  and  it  was  the  recognition  of  the  fact 
that  pilots  under  pressure  in  battle  situations  were  quite  likely  to  exceed  the  desiqn 
manoeuvre  envelope  which  led  to  the  first  application  of  operational  recording  with  the 

V  g  recorder.  This  was  a  simple  device  which  lecorded  the  speed  V  and  the  normal 
acceleration  'g'  continuously  throughout  the  fliqht.  These  recorders,  which  could  be 
left  indefinitely  in  an  aeroplane,  scribed  on  a  glass  slide  a  continuous  trace  in  the 

V  g  plane  (Fiq  1).  If  left  in  the  aeroplane  long  enouqh,  the  total  operational  flight 
envelope  would  be  drawn.  By  comparing  the  actual  operational  envelope  with  the  design 
envelope  it  was  possible  to  see  the  degree  to  which  they  were  consistent.  Data  from  a 
more  recent  report  on  some  general  aviation  aeroplanes  serves  to  illustrate  the 
variations  which  can  arise  depending  on  the  manner  in  which  the  aeroplane  is  flown,  and 
the  purpose  for  which  it  is  flown.  Figure  2  shows  the  V  g  record  for  an  executive 
aeroplane  flown  by  a  professional  pilot.  The  operation  is  contained  well  within  the 
design  envelope,  the  small  area  outside  the  envelope  at  the  low  speed  end  comes  from  the 
landing  normal  accelerations.  Figure  1  shows  a  personal  aeroplane,  and  here  we  see  that 
the  design  diving  speed  Vq  is  often  reached,  and  even  slightly  exceeded.  Given  that  the 
maximum  permitted  speed  V^e  is  at  least  10*  below  Vp,  we  see  that  the  private  operator 


A 


3-2 


frequently  exceeds  the  maximum  permitted  speed.  He  also  produces  higher  landing  loads 
than  the  professional  pilot.  In  Figure  4  the  envelope  is  handsomely  exceeded  with  the 
aeroplane  being  used  in  the  pilot  instruction  role,  and  one  wonders  why  the  aeroplane  did 
not  break,  and  in  Figure  5  there  is  no  boundary  of  the  envelope  which  is  not  exceeded  when 
the  aeroplane  is  used  for  aerobatics.  It  can  be  seen  that  extremely  valuable  information 
was  obtained  from  this  simple  recorder. 

After  the  war  the  V  g  recorder  was  followed  by  the  V  g  h  recorder.  This  recorder  also 
ran  continuously  and  produced  analogue  traces  of  speed,  normal  acceleration  and  height 
on  a  paper  band  (Figure  6),  and  when  the  Boeing  707  came  to  Enqland  they  were  used  to 
monitor  the  early  operations  of  the  first  aircraft  on  the  British  register.  An  additional 
use  of  the  data  from  V  g  h  recorders  on  American  civil  aeroplanes  was  to  provide  a 
statistical  picture  of  the  atmosphere  which  formed  the  basis  of  the  design  gust 
requirements  in  both  British  and  American  airworthiness  requirements,  which  still  apply 
today . 

The  real  beginning  of  CAADRP  came  in  1962  when  i_he  ARB  (now  the  Airworthiness  Division 
of  the  CAA)  in  conjunction  with  the  Ministry  of  Aviation,  and  the  Royal  Aircraft 
Establishment  set  up  a  programme  to  install  and  operate  special  12  channel  recorders  in 
a  small  number  of  aeroplanes  of  BOAC  and  BEA  (now  united  as  British  Airways).  These 
recorders  used  a  light  beam  to  produce  a  continuous  analogue  trace  of  each  parameter  on 
photographic  paper.  The  output  from  these  recorders  were  examined  by  CAA  personnel 
looking  for  any  occurrences  which  were  out  of  the  ordinary  and  wou . d  represent  some 
erosion  of  safety  margins.  No  specific  rules  were  set  out  for  this  search,  reliance  being 
placed  on  the  knowledge  and  imagination  of  the  scrutineers.  Occurrences  detected  in  this 
way  were  called  Special  Events,  and  their  safety  implications  were  discussed  with  the 
operating  airline. 

The  next  major  step  came  in  1966  when  the  carriage  of  crash  recorders  became  mandatory 
in  the  UK.  To  comply  with  this  requirement  British  Airways  elected  to  fit  digital 
recorders,  but  in  addition,  havinq  been  sufficiently  encouraged  by  the  results  of  the 
earlier  programme,  they  decided  to  complement  the  crash  recorder  with  a  second  recorder 
running  in  parallel  but  having  a  quick  access  cassette.  The  first  aeroplanes  to  be 
equipped  in  this  way  were  the  Trident,  but  now  nearly  all  British  Airways  aeroplanes 
have  recorders  with  quick  access  cassettes.  The  change  from  12  channel  analogue 
recorders  on  only  5  aeroplanes  to  digital  recorders  having  much  larger  capacity,  on 
every  aeroplane,  magnified  the  data  flow  by  an  enormous  factor,  and  made  it  quite 
impractical  to  search  manually  for  Special  Events.  Fortunately  one  advantage  of  data  in 
digital  form  is  that  it  lends  itself  readily  to  handling  by  computer.  The  system  which 
evolved  has  been  operating  since  that  time,  and  although  there  have  been  improvements 
both  in  the  airborne  recording  equipment  and  the  ground  replay  equipment,  and  in  methods 
of  handling  the  data,  the  essential  features  of  the  system  have  not  changed  and  these 
are  described  later.  Both  British  Airtours,  and  Gulf  Air  have  similarly  equippped 
aeroplanes  and  operate  through  British  Airways.  British  Caledonian  Airways  have 
similarly  equipped  some  of  their  aeroplanes  and  operate  an  independent  programme,  but  all 
par t ic ipat ing  airlines  cooperate  on  the  discussion  analysis  and  uses  of  the  data. 

3 .  Aims  and  Objectives 

It  is  not  sufficient  to  say,  as  I  did  earlier,  that  the  objective  is  safety,  it  is 
necessary  to  indicate  the  means  by  which  safety,  i.e.  the  maintenance  or  reduction  of 
the  accident  rate  can  be  achieved.  More  specifically  then  the  objectives  are: 

(i)  Statistical  validation  of  certification  assumptions,  suggesting  remedial  action 
where  necessary  (e.g.  take-off  and  landing  performances,  adherence  to  operational  speeds 
and  1 lmi ta t ions ) . 

(ii)  To  detect  unusual  behaviour  or  situations  which  could  be  hazardous  (e.g.  large 
amplitude  oscillation  with  Flight  Management  Systems  engaged,  effect  of  building  induced 
turbu lence) . 

(iii)  To  identify  potential  problem  areas  where  safety  margins  may  be  eroded  (e.g. 
probability  of  a  tail  or  pod  scrape  as  a  result  of  cross  wind  landing  techniques. 

Effect  of  changed  procedures.  Problems  at  particular  airfields). 

(iv)  To  provide  back  up  data  for  specific  investigations  of  incidents. 

(v)  To  support  research  programmes  (e.g.  re-eva 1 uat ion  of  gust  statistics,  low  level 
wind  shear,  en-route  vertical  separation,  vortex  wakes). 

(vi)  To  support  work  on  development  of  airworthiness  requirements. 

4 .  Organisation  and  Administration 

Since  its  inception  CAADRP  has  been  a  cooperative  venture,  and  although  there  have  been 
many  changes  both  in  the  way  in  which  the  system  is  operated  and  financed,  and  the  roles 
performed  by  the  various  participants,  we  all  still  work  together  towards  the  same  broad 
objective  of  safety.  At  present  CAADRP  is  managed  operated  and  financed  by  the  airlines 
involved  and  the  CAA,  and  this  means  agreement  on  the  contents  of  the  programme,  its 
conduct  and  its  cost.  Another  essential  party  to  the  agreement  is  BALPA  (British  Airline 
Pilots  Association)  whose  interests  are  carefully  safeguarded. 


The  largest  contributor  to  the  programme  is  British  Airways  with  nearly  all  their 
aeroplanes : - 


4  Trident  1 

9  Trident  2  ' 

25  Trident  3 

18  1-11  Type  510 

3  1-11  Type  519 

9  Tristar  -  1 

8  Tristar  200 

6  Tristar  500  Active  Controls 

19  7  37 

16  747-136 

10  747-236 

6  Concorde 

2  767 

British  Airways  also  handle  data  from  7  Tristar  200‘s  of  Gulf  Air  and  9  Boeing  737‘s  of 
British  Air  tours. 


British  Caledonian  Airways  have  4  DClO's  equipped,  and  data  from  these  aeroplanes  is 
handled  separately  through  a  computer  bureau. 

Althouqh  the  recording  equipment  used  is  not  the  same  on  all  types  of  aeroplanes  handled 
by  British  Airways,  they  all  perform  similar  tasks  and  are  dealt  with  in  the  same  way. 
The  aim  is  to  record  and  replay  every  flight,  but  100%  coverage  is  not  achieved  for  a 
variety  of  reasons.  The  duration  o'  the  cassettes  varies  with  the  type  of  operation. 

For  the  short  haul  operations  the  cassette  duration  is  14  hours,  and  for  the  long  haul 
60  hours.  The  cassettes  are  inserted  into  the  recorder  by  ground  engineers  except  in 
the  case  of  the  Tristar  where  t he  cassette  is  carried  onto  the  aeroplane  and  inserted 
into  the  recorder  by  the  crew.  Additional  cassettes  are  available  to  provide  cover  for 
all  flying  when  the  aeroplane  is  away  from  base  for  a  long  time.  All  cassettes  are 
returned  to  the  British  Airways  Flight  Data  Recording  Section  at  Heathrow  for  replay. 

In  the  case  of  British  Caledonian  Airways  the  number  of  cassettes  handled  is  limited, 
and  the  replay  is  performed  by  a  commercial  bureau. 

Altogether,  about  170,000  hours  of  flying  is  recorded  annually  and  processed  in  CAADRP . 


Technical  Description 


The  12  channel  analogue  records  with  which  CAADRP  started  in  1962  were  examined  manually 
for  undefined  Special  Events.  With  the  change  to  digital  recorders  the  number  of  parmeters 
recorded  was  greatly  increased,  and  in  addition  to  flight  parameters  which  vary 
continuously  such  as  speed,  height,  bank  angle,  heading,  pitch  altitude  etc,  it  was 
possible  to  include  discrete  signals,  such  as  gear  up,  gear  in  transit,  gear  down,  which 
auto  pilot  or  auto  throttle  was  engaged  and  in  which  mode.  A  typical  list,  is  given  in 
Appendix  1.  The  change  to  diqital  recorders  also  made  essential  the  examination  of  the 
data  by  computer, and  it  was  therefore  necessary  to  define  very  precisely  those  Special 
Events  which  the  computer  was  required  to  detect.  Here  the  experience  gained  with  the 
earlier  analogue  records  was  very  useful.  A  working  group  with  members  from  the  airlines 
and  CAA  was  set  up  to  define  an  appropriate  set  of  Special  Events  and  these  were  written 
into  a  computer  program  SESMA  (Special  Event  Search  and  Master  Analysis).  A  typical  list 
of  Special  Events  is  given  in  Appendix  2.  The  use  of  digital  data  introduced  some 
difficulties,  particularly  where  precise  timing  was  necessary  andthe  loss  of  resolution 
due  to  a  low  sampling  rate  led  to  greater  complexity  in  the  program.  The  workinq  group 
then  met,  and  continues  to  meet,  as  required  to  resolve  problems  with  the  search  program, 
to  improve  event  detection  methods,  to  introduce  new  events  and  to  up-date  the  program 
in  the  light  of  experience.  The  proqram  currently  in  operation  is  the  12th  Version  of 
SESMA.  Data  from  various  transducers  on  the  aeroplane  fed  continuously,  usually  in  the 
form  of  varyinq  voltaqe,  into  a  data  management  unit.  Data  from  this  unit  was  sampled 
n  a  fixed  sequence  and  then  converted  into  diqital  form  before  beinq  fed  onto  the 
recorder.  Not  all  parameters  were  sampled  at  the  same  rate,  those  that  change  slowly 
were  sampled  less  frequently  than  those  that  changed  quickly,  the  extremes  beinq  engine 
parameters  which  were  sampled  once  every  four  seconds,  on  one  aeroplane,  and  normal 
acceleration  which  was  sampled  at  8  times  per  second  on  all  aeroplanes.  Each  cassette 
is  subjected  to  a  search  by  SESMA  and  when  the  computer  detects  a  Special  Event  it 
au t omat i ca 1 1 y  printed  out  an  analoque  trace  of  the  most  important  parameters  and 
discrete  signals,  about  20  in  all,  for  a  period  from  two  minutes  before  the  event  till 
two  minutes  after  the  event.  This  print  out  included  the  scales  for  all  the  parameters 
shown,  and  additional  information  relevant  to  the  flight,  such  as  take-off  and  landing 
weights,  weiqht  at  the  time  of  the  event,  location  of  event  etc.  A  typical  output  is 
shown  in  Figure  7.  It  is  evident  that  the  print  out  does  not  contain  all  the  information 
present  on  the  recorder,  but  this  does  not  mean  that  any  of  the  data  is  lost.  It  is 
always  possible  to  replay  a  cassette  and  produce  listinqs  in  engineering  units,  of  all 
the  data  which  has  been  recorded,  in  cases  where  the  additional  information  is  required 
for  the  study  of  a  particular  event.  For  this  reason  cassettes  are  not  recycled 
immediately  but  held  in  store  for  about  one  month,  and  then  recycled.  It  is  the  Special 
Events  and  the  frequency  with  which  they  occur  which  forms  the  main  basis  of  the  analysis 
work . 
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The  Special  Event  analogue,  when  it  is  first  printed,  contains  enough  information  to 
identify  the  flight,  so  that  additional  information  such  as  entries  in  the  aeroplane 
Technical  Log,  records  of  the  prevailing  meteorological  conditions,  runway  condition  etc. 
can  be  made  available  in  such  cases  where  a  detailed  study  of  the  event  is  necessary. 

All  Special  Events  found  are  entered  into  a  data  bank  which  is  held  on  disc.  This  data 
bank  can  be  interrogated  in  a  variety  of  ways  so  that  statistics  relevant  to  a  particular 
type  of  event,  or  a  particular  type  of  aeroplane  or  even  a  particular  airfield  can  be 
extracted.  The  information  about  each  Special  Event  which  is  entered  into  the  data  base 
is  deliberately  made  insufficient  to  identify  the  flight  on  which  it  occurred  and  hence 
identify  the  pilot.  Similarly,  those  items  of  information  which  would  enable  the  flight 
to  be  identified  are  eliminated  from  the  analogue  print  out  after  a  fixed  time  lapse. 

These  actions  ensure  that  none  of  the  stored  data  can  be  associated  with  a  particular 
pilot,  and  it  can  never  be  used  to  comment  on  any  pilots  performance. 

A  Flight  Operation  Working  Panel  in  British  Airways  meets  regularly  to  discuss  event 
rates  and  trends  revealed  by  the  statistics,  and  where  necessary  it  will  discuss 
individual  events  of  potentially  special  interest.  Although  the  pilots  anonymity  is 
always  strictly  preserved  he  may  at  this  stage  be  contacted  for  information  by  the 
BALPA  representative  on  the  Working  Panel.  It  is  emphasised  that  the  intention  of  these 
enquiries  is  to  seek  a  better  understanding  of  an  event  which  occurred,  and  in  no  way 
reflects  on  or  comments  on  or  accuses  the  pilot.  Additionally  the  data  is  used  within 
the  airline  in  a  number  of  other  areas  such  as  engine  health  monitoring,  collection  of 
data  in  support  of  autoland  clearance,  monitoring  of  data  sources  for  the  mandatory 
'crash'  recorder,  etc.  Detailed  analysis  of  Special  Events  which  forms  the  main  part 
of  the  CAA  activity  is  illustrated  by  some  examples  in  the  next  paragraph. 

6 .  Illustrative  Examples 

6.1  Turbulence: 

One  particular  Special  Event,  airborne  normal  acceleration ,  has  attracted  much  of  our 
analysis  effort  recently,  and  has  provided  data  which  has  been  useful  in  a  number  of  ways. 
Flight  through  turbulence  is  detected  by  the  behaviour  of  the  normal  acceleration  measured 
at,  or  close  to,  the  centre  of  gravity  of  the  aeroplane.  Turbulence  severe  enough  to 
produce  large  structural  loadings  was  detected  as  a  Special  Event  at  an  arbitrarily 
chosen  excursion  of  i  0.7  g.  The  detection  method  could  not  distinguish  between  g  due 
to  gust  and  g  due  to  manoeuvre.  However,  since  the  printed  analogue  output  for  each 
event  included  other  parameters,  in  particular,  heading,  bank  angle,  pitch  attitude  and 
some  control  surface  positions,  it  was  possible  to  say,  from  manual  examination  of  the 
data,  whether  any  manoeuvring  took  place  and  estimate  its  contribution  to  the  normal 
acceleration  excursion. 

6.1.2  Comoined  Turbulence  and  Manoeuvre: 

Although  encounters  detected  at  this  level  were  relatively  small  in  number  sc  vie  unexpec*-~d 
features  were  revealed.  It  was  found  that  the  percentage  of  occasions  when  ■  •  ulenct  ,u 
manoeuvre  combined  to  accentuate  the  'g'  excursion  was  much  higher  than  h.<"  b'tn  assumed. 
This  fact  was  of  particular  importance  for  studies  on  active  control  aerop,..nes  where 
load  alleviation  and  manoeuvre  use  the  same  control  surface.  Figure  8  illustrates  a 
coincidence  of  the  two  'g'  sources. 

6.1.3  Vortex  Wake: 

The  second  type  of  occurrence.  Figure  9  was  a  very  sharp  excursion  or  series  of  excursion, 
of  very  short  duration,  whilst  cruising  in  completely  calm  conditions  at  high  altitude. 

The  most  probable  explanation  of  such  events  was  the  encounter  of  the  vortex  wake  of  a 
leading  aeroplane.  Attention  was  drawn  particularly  to  the  event  shown  in  Figure  9 
because  of  its  magnitude.  An  analysis  of  the  event  carried  out  by  W.  Pinsker  at  R.A.E. 
Bedford  was  able  to  deduce  the  intercept  path  with  the  vortex  wake  and  explained  the 
pattern  of  the  'g'  and  bank  angle  histories.  Estimates  of  the  asymmetric  spanwise  wing 
loading  then  indicated  that  very  high  wing  root  bending  moments  may  have  been  reached. 
Another  outcome  of  the  R.A.E.  analysis  was  the  apparently  very  slow  decay  rate  of 
vortices  at  high  altitude.  We  have  since  been  trying  to  collect  data  on  similar  incidents 
combined  with  radar  records  from  which  the  flight  paths  of  the  two  aeroplanes  involved 
can  be  obtained.  When  a  sufficient  body  of  data  has  been  collected  it  may  be  possible 
to  make  some  estimate  of  the  effect  of  altitude  on  the  rate  of  decay  of  trailing 
vortices,  and  also  on  the  probability  of  a  severe  encounter. 

6.1.4  Distribution  of  Atmospheric  Turbulence: 

For  the  purpose  of  a  special  study  undertaken  by  ONERA  a  much  larger  body  of  data  was 
required,  and  to  achieve  this  the  detection  level  for  the  airborne  normal  acceleration 
Special  Event  was  reduced  to  !  0.5  g,  which  produced  about  60  events  per  month.  The 
ONERA  work  on  the  distribution  of  turbulence  patches  in  the  atmosphere  is  still  continuing 
and  will  be  reported  elsewhere.  One  iiteresting  feature  revealed  by  the  analysis  so  far 
was  the  very  large  difference  between  the  gust  probability  deduced  from  the  Boeing  747 
data  and  that  from  the  Lockheed  Tristar.  Since  there  was  no  reason  to  suppose  that  the 
atmosphere  through  which  the  747  flew  was  any  different  from  that  flown  by  the  Tristar, 
and  since  the  recorded  data  was  not  suspect,  an  explanation  had  to  be  found  in  the 
analysis.  In  practice  there  is  relatively  little  variation  in  the  cruise  speeds  flown 
by  the  two  aeroplanes,  so  for  each  aeroplane  the  g  produced  by  a  given  gust  will  vary 
with  aeroplane  weight.  If  the  weight  at  which  a  gust  of  given  magnitude  produces 
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n.5  q  is  hiqh  relative  to  the  average  weight  then  that  gust  will  be  seen  more  frequently 
than  if  the  weight  is  low  relative  to  the  average.  The  difference  in  the  0.5  g  cut  off 
weights  of  the  two  aeroplanes  explained  the  difference  seen  in  the  rate  of  encountering 
gusts . 

The  data  also  revealed  that  flight  on  some  routes  were  more  prone  to  turbulence  than 
others,  the  extreme  example  being  the  Berlin  corridor  where  aeroplanes  were  flying  at 
10,000  feet  and  inhibited  from  taking  vertical  or  horizontal  storm  avoidance  action. 

Here  the  frequency  of  gust  encounter  was  very  much  greater  than  average,  and  individual 
aeroplanes  which  were  used  frequently  on  that  route  were  subject  to  a  much  higher  rate 
of  fatigue  damage. 

6.1.5  Height  Excursions: 

Using  the  same  set  of  recordings,  data  on  height  excursions  in  cruise  has  been  extracted 
to  provide  a  statistical  picture  of  the  probability  of  deviating  from  an  assigned  flight 
level.  This  data  was  prepared  for  a  study  on  vertical  separation  standards.  Figure  10 
shows  the  probabilities,  for  one  aeroplane  type,  of  exceeding  various  height  deviations 
derived  from  the  turbulence  data.  It  must  be  pointed  out,  however,  that  these  probabilities 
must  be  an  under  estimate,  as  it  is  possible  for  quite  large  height  excursions  from  the 
assigned  height  to  occur  without  g  exceeding  t  0.5.  An  example  of  such  an  excursion  is 
shown  in  Figure  11. 

6.1.6  Wind  Shear  on  Approach: 

This  aspect  of  turbulence  in  which  the  headwind  component,  derived  from  the  difference 
between  calibrated  airspeed  CAS  and  inertia  ground  speed  IGS,  is  examined  for  the  presence 
of  windshear  is  the  subject  of  Mr.  Woodfield's  paper  later  in  this  symposium. 

6.1.7  Monitoring  of  Lockheed  Tristar  with  Active  Controls: 

The  cert i f ica t ion  of  the  active  control  aeroplane  required  that  certain  assumptions 
regarding  the  behaviour  and  reliability  of  the  active  control  system  be  verified  in 
service  by  agreed  analyses  of  recorded  data  supplied  by  British  Airways  to  Lockheed.  That 
verification  work  is  not  covered  in  this  paper,  but  a  direct  measure  of  the  effectiveness 
of  the  active  control  system  was  possible  by  comparing  the  behaviour  of  the  aircraft  in 
turbulence  before  and  after  active  controls  were  fitted.  Figure  11  shows  the  frequency 
of  'g'  excursions  for  the  two  cases,  from  which  it  seems  that  a  significant  reduction  in 
the  aeroplanes  response  to  turbulence  has  been  achieved.  However,  the  sample  size  is  too 
small  to  allow  firm  conclusions  to  be  drawn. 

6.2  Abandoned  Take-off: 

The  scheduled  acce lera t e-stop  distances  which  appear  in  the  aeroplane  Flight  Manual,  are 
based  on  measurements  made  during  certification.  In  making  these  measurements  a  standard 
delay  of  one  second  is  used  between  successive  pilot  actions  following  the  decision  to 
abort.  This  arbitrary  delay  time  was  chosen  as  being  representative  of  pilot  behaviour 
in  an  emergency  stop,  but  has  freguently  been  questioned  and  criticised  for  being  too 
short.  In  order  to  get  a  measure  of  real  operational  delay  times  a  study  of  high  speed 
aborted  take-offs  was  made.  The  study  included  only  those  take-offs  which  were  aborted 
above  100  kts,  since  in  low  speed  aborts  with  no  great  urgency  to  stop,  the  delays  would 
not  be  representative.  Fortunately  aborts  from  high  speed  are  relatively  rare  occurrences 
so  that  collection  of  data  has  gone  fairly  slowly.  Data  from  16  take-offs  have  been 
analysed  so  far,  although  in  many  cases  the  data  is  incomplete,  so  no  clear  picture  is 
yet  emerging,  but  it  does  seem  that  delay  times  as  short  as  one  second  are  not  common. 

An  interesting,  although  expected  outcome  from  this  work  is  the  relationship  between 
decision  speed  Vj  and  the  probability  of  aborting  a  take-off  above  100  kts.  Figure  12 
shows  the  aborted  take-off  probability  for  a  number  of  aeroplane  types,  and  it  can  be 
seen  that  there  is  a  large  increase  in  probability  as  Vj  increases.  This  must  be  due,  in 
part  at  least,  to  the  longer  time  spent  above  100  kts  on  the  aeroplanes  with  the  higher 
Vis . 

6.3  Scheduled  Take-off  Speeds: 

Scheduled  take-off  speeds  cater  for  the  possibility  of  losing  one  engine  and  are  governed 
by  performance  and  handling  considerations,  and  are  further  complicated  by  noise  abatement 
procedures.  Significant  departure  from  these  scheduled  speeds  erode  the  safety  margins 
and  represent  a  hazard,  particularly  in  the  case  of  speeds  below  the  scheduled  speed.  In 
the  case  of  the  747  it  was  found  that  there  was  a  high  frequency  of  'speed  high’  events 
on  the  -136  and  a  high  frequency  of  'speed  low'  events  on  the  -236.  Apart  from  the  engines 
the  aeroplanes  are  identical  except  for  the  higher  maximum  weight  to  which  the  -236  is 
certificated.  Investigation  of  these  events  revealed  that  because  the  stick  forces  at 
take-off  were  modified  by  the  trim  setting  the  heavier  -236  had  lighter  stick  forces  for 
rotation  with  a  consequent  tendency  to  over  rotate  and  hence  become  airborne  with 
excessive  pitch  altitude  resulting  in  a  fall  in  speed.  Once  the  source  of  the  problem 
was  recognised  it  was  remedied  by  appropriate  advice  to  the  crews. 


6.4  Speed  Losses  on  Approach: 


A  significant  loss  of  speed  from  the  steady  approach  speed  is  detected  as  a  Special  Event, 
and  it  was  noted  that  there  was  a  large  difference  between  the  frequencies  of  occurrence 
of  this  event  on  the  747-136  and  the  747-236.  Since  the  same  crews  fly  both  aeroplanes 
the  cause  was  looked  for  elsewhere.  A  probable  explanation  was  found  in  the  fact  that  the 
flight  idle  thrust  of  the  RB  211  engines  was  much  lower  than  that  of  the  JT9 ,  so  that  the 
747-236  with  RB  211s  suffered  a  greater  deceleration  than  the  747-136  when  the  throttles 
were  closed.  When  the  pilots  attention  was  drawn  to  this  difference,  the  problem 
disappeared. 

6.5  High  Altitude  Buffet  Margin: 

At  high  altitude  the  measurement  of  maximum  lift  coefficient  is  determined  by  the  maximum 
intensity  of  Mach  buffet  which  the  manufacturer  is  prepared  to  demonstrate.  In  normal 
operations  the  altitude  is  limited  to  ensure  an  adequate  margin  to  the  maximum  demonstrated 
lift  coefficient.  Any  diminution  of  this  marqin  is  detected  as  a  Special  Event.  Our 
experience  has  been  that  this  is  a  rare  event,  so  when  its  frequency  increased  markedly 
on  the  L1011  there  was  a  need  to  investigate  the  cause.  The  increase  in  frequency  was 
found  to  coincide  with  the  introduction  of  the  Flight  Management  System,  and  on 
investigation  it  was  found  that  this  system  had  been  incorrectly  programmed  and  was 
flying  the  aeroplanes  too  high. 

7 .  Limitations  of  Flight  Recording 

The  flight  recorder  programme  produced  useful  data  in  many  areas,  and  a  few  examples  have 
been  quoted  above,  however,  it  must  be  admitted  that  quite  excitinq,  and  potentially 
dangerous  events  can  occur  without  triggering  any  of  the  SESMA  limits.  To  illustrate  this 
point  Figuie  13  shows  an  upset  to  a  Tristar  in  which  an  initial  height  gain  was  followed 
by  a  4,000  feet  height  loss,  and  a  descent  rate  of  6,000  feet  per  minute  was  reached. 

This  occurrence  was  brought  to  our  attention  by  the  Mandatory  Occurrence  Reporting  System 
which  operates  in  the  UK  and  requires  all  personnel  to  report  situations  which  have 
hazarded  the  aeroplane.  It  is  quite  rare  to  find  any  coincidence  between  Occurrence 
Reports  and  Special  Events  due  to  the  difference  between  the  two  systems.  The  Special 
Event  levels  are  generally  set  at  a  relatively  low  hazard  level  that  would  not  justify 
raising  an  O.R.  although  sometimes  the  recorder  does  see  situations  which  the  crew  may 
miss.  On  the  other  hand  the  Occurrence  Reports,  by  definition,  cover  such  a  wide  range 
of  situations  often  involving  a  combination  of  factors  that  could  not  be  defined  in  terms 
of  a  Special  Event. 

8 .  Future  Work 

8.1  Structural  Loads: 

In  our  present  programme  the  only  parameter  giving  an  indication  of  structural  load  is 
the  accelerometer  at  the  centre  of  gravity.  From  work  which  has  been  conducted  by  the 
R.A.E.  Farnborough  on  strain  gauge  measurements  on  a  number  of  aeroplanes  there  are 
indications  that  large  loads  can  arise  in  the  structure  during  manoeuvres  which  are  not 
accounted  for  in  the  design  requirements.  It  would  therefore  be  useful  to  record 
additional  data  to  assess  the  magnitude  of  this  problem  in  civil  aeroplanes  operations. 

8.2  Flight  Recording  on  Helicopters: 

The  increase  in  numbers  and  passenger  carrying  capacity  of  helicopters,  and  the  fact  that 
their  accident  rate  appears  to  be  higher  than  that  of  fixed  wing  aeroplanes  all  point 
to  the  need  for  a  better  understanding  of  helicopter  operations.  To  this  end  the 
possibilities  of  recording  operational  data  on  some  civil  helicopters  is  being  actively 
pursued . 
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APPENDIX  ] 


Aircraft  Type:  B737-2326 

System  Type:  PVS1940 

Recorder  Type:  QAR/DFDR 


VARIABLES 


ACRONYM 


ALT 

ALTC 

ALTF 

CALI 

CPP 

CPR 

DOC 

EPR 

FF 

FLAP 

GMT 

GS 

GW 

HDGM 

IAS 

LATA 

LNGA 

LOC 

N2 

NMLA 

PITCH 

RALIH 

RODB 

RODR 

ROLL 

RUDP 

SBLP 


STAB 


PARAMETER 


Pressure  altitude  (combined  coarse  and  fine) 

Pressure  altitude  -  coarse 

Pressure  altitude  -  fine 

System  calibration  word 

Control  column  position  -  pitch 

Control  wheel  position  -  roll 

Data  management  entry  panel  data  (AIDS  panel) 
Engine  pressure  ratio  Engine  Nrs.  1,  2 
Fuel  flow  rate  Engine  Nrs.  1,2 
Flap  -  trailing  edge  position 
Greenwich  mean  time 
Glideslope  deviation  7f>pA  =  1  dot 
Gross  weight 
Heading  -  Magnetic 
Indicated  airspeed 
Lateral  acceleration 
Longitudinal  acceleration 
Local iser  deviation  7SpA  =  1  dot 
N2  spool  RPM  Engine  Nrs.  1,2 
Normal  acceleration  (not  corrected  for 
datum  errors) 

Pitch  attitude 

Radio  height  Nr.  1  (high  range) 

Rate  of  descent,  barometric  (AIDS  computed 
value) 

Rate  of  descent,  radio  (AIDS  computed  value) 
Roll  attitude 
Rudder  pedal  position 
Speed  brake  lever  position 
In  armed  detect  -  4.0  deg) 

In  flight  detect  --  40. s  deg)  no"11  n“ 

Full  up  -  S1.0  deg)  VdlueS 

Stabiliser  position 


SUBFRM 

TAT 

DISCRETES 


ACRONYM 


AACQ 

AFW 

AHLD 

APAM 

APBM 

APAW 

APBW 

APPR 

AOW 

ATE 

ATME 

ATMP 

ATMS 

DFDR 

KF 

EO 

FA 

FE 

GA 

GDW 

OLD 

GPWS 

GSE 

FDAU 

HE.  A 

HP .  B 

HP .  O 


Subframe  number  and  position  of  second  in 
4  second  data  frame 
Total  air  temperature 


PARAMETERS 


A 1 1 1 1  ude  Acgu  ire 
APU  fire  wa r n i ng 
A 1 1 1 1  ude  ho  1 d 
A/P  engage  A  CMD 
A/P  engage  B  CMD 
A/P  engage  A  CWS 
A/P  engage  B  CWS 
Approach 

APU  overheat  warning 
Autothrottle  engage 
Autothrottle  mode  _  EPR 
Autothrottle  mode  -  PDC  speed 
Autothrottle  mode  -  IAS 
DFDR  stat  us  f 1 aq 

Engine  fire  warning  Engine  Nrs.  1,2 
Engine  overheat  warning  Engine  Nrs.  1,2 
Flare  armed 
Flare  engage 
Go  around 

Glideslope  deviation  warning 

Gear  lever  down 

Ground  proximi'y  warning 

Glideslope  engaqe 

FDAU  unit  status  flap 

Hydraulic  system  A  Enqines  Nrs.  1,2 

Hydraul ic  system  B  Pump  Nrs.  1,2 

Hydraulic  system  pump  overheat  Engine  Nrs.  1,2 


UNITS 

feet 

feet 

feet 

units 

degrees 

degrees 

octa  1 

units 

kgs/hr 

degrees 

hrs/mins 

pA  ♦=  above  G/S  (fly  down) 
kgs 

degrees 
knots 
g  units 
g  units 

pA  ♦ =  left  (fly  right) 

%  RPM 
g  units 

degrees  *=nose  up 
feet  AGL 
feet /min 

feet /min 

degrees  *  =  nght  wing  low 

degrees 

degrees 


units  of  trim  0=3  deg 
L.E.  up  17  units  =  14  deg 
L.E.  up 


degrees  C 


STATUS 

1  - acqu i re 
1 ^warning 
1 -hold 
1 = se lected 
1 -selected 
1  ■-  selected 
1 =  se lected 
1  =  se 1  net  ed 
1 -warning 
1  engaqe 
1 "selected 
1 -selected 
1 =so lected 
1  -  f  a  i  1 
1  warn i nq 
1 -warn i ng 
1  -  armed 
1 =engaqed 
1 =  pressed 
1 = warn l ng 
1  down  se 1 ect ed 
1 -warning 
1  engaged 
1  f  ai  1 
1 = warning 
1 = warn l nq 
1 =overheat 
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ACRONYM 

HQB 

HQS 

LCHG 

LOW 

LF.E 

LF.T 

PDCE 

PEV 

PW 

RT.E 

RT.U 

SL.E 

SL.M 

SL.T 

SQSW 

STD 

STO 

VHF 

VLA 

VLE 

WWF 


PARAMETER 


Hydraulic  system  B  -  quantity 
Hydraulic  system  -  stand-by  quantity 
Level  change 

Localiser  deviation  warning 

Leading  edge  flap  -  extended  Section  Nrs.  1, 
2,3  and  4 

Leading  edge  flap  -  in  transit  Section  Nrs.  1, 
2,  3  and  4 
P.D.C.  engage 
Pilot  event  marker 
Pressurisation  warning 
Reverse  thrust  extend  Engine  Nrs.  1. 

Reverse  thrust  unlock  Engine  Nrs.  1,  2 

Slat  -  full  extend  Positions  1-6 

Slat  -  mid  extend  Positions  1-6 

Slat  -  in  transit  Positions  1-6 

Squat  switch 

Stabiliser  trim  -  DOWN 

Stabiliser  trim  -  UP 

VHF  keyed  Nrs.  1,2 

VOR/LOC  arm 

VOR/LOC  engage 

Wheel  well  fire 


STATUS 

1  =  low 
1  =  low 

1 ^selected 
1  =warnin'g 
1-full  extend 

(  l=intransit 
(  0=loeked  in 
1 ^engaged 
1-pressed 
1 =auto-f ai 1 
1 =extend 
1 =unlock 

l=full  extend  position 
l=mid  extend  position 
l=in  transit 
1 =made 
1 ^activated 
1 =acti vated 
Impress  to  transmit 
1 =armed 
1 =engaged 
1 ^warning 
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TWO  DECADES  OF  AIR  CARRIER  JET  OPERATION 
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SUMMARY 

AGARD  and  the  Flight  Mechanics  Panel,  in  holding  this  third  conference  on  aircraft 
accidents,  operations  and  safety  have  recognized  the  close  relationship  between  civil 
and  military  aviation  safety  problems.  This  presentation  examines  the  accident  record 
of  the  world  fleet  of  air  carrier  jet  aircraft  from  1960  to  1981.  Comparisons  of  total 
accidents,  fatal  accidents,  and  hull  losses  for  this  time  period  are  reviewed  against 
numbers  of  departures  and  hours  flown.  It  is  shown  that  there  is  a  close  correlation 
between  fatal  accidents  and  hull  losses  and  that  there  has  been  a  general  stabilizing 
of  the  accident  rate  in  the  past  decade  of  two  to  four  accidents  (hull  losses)  per 
million  departures  with  the  probability  that,  if  no  changes  are  introduced,  this  rate 
will  remain  essentially  unchanged. 

Since  hull  losses  reflect  fatal  accidents,  a  geographic  comparison  is  made  of  these 
losses  for  1975  and  1981  showing  that,  although  significant  improvements  have  been  made 
in  these  countries,  Asia,  Africa  and  Central  and  South  America  remain  the  areas  with 
the  highest  accident  rates. 

Costs  of  accidents  are  also  presented  from  1975  to  1981.  Although  the  rates  of  acci¬ 
dents  have  remained  essentially  constant,  the  associated  costs  of  those  accidents  has 
increased  dramatically. 

Phases  of  operations  where  accidents  have  occurred  are  also  examined,  showing  that 
over  50  percent  of  the  fatal  accidents  have  occurred  during  14  percent  of  the  operational 
exposure  time  spent  in  initial  approach,  final  approach,  and  landing.  Of  this  50  percent, 
nearly  40  percent  have  occurred  in  the  initial  and  final  approach  phases. 

The  data  tells  us  that  our  airframes  systems  and  powerplants,  as  well  as  maintenance 
air  traffic  control  and  weather  factors  have  reached  a  high  level  of  reliability  and 
that  the  human  factor  is  still  the  prevalent  factor  in  the  existing  accident  rates. 
Operator  error  has  remained  at  over  70  percent. 

Since  it  is  reasonably  predictable  that  future  accidents  will  occur  in  or  near  a 
major  airport  and  will  probably  involve  post  crash  fire,  safety  measures  in  this  area 
are  also  discussed. 

INTRODUCTION 

In  order  to  discuss  accident  and  hull  loss  statistics,  it  is  appropriate  to  review 
the  definition  of  these  terms.  Figure  1  shows  the  U.S.  National  Transportation  Safety 
Board  terms  which  have  been  used  in  this  presentation. 


ACCIDENT  DEFINITIONS 

U.  S.  NATIONAL  TRANSPORTATION  SAFETY  BOARD 


“AIRCRAFT  ACCIDENT*  MEANS  AN  OCCURRENCE  ASSOCIATED  WITH  Th[  OPE  RATION  Of  AN 
AIRCRAFT  THAT  TAKES  PLACE  BETWEEN  THE  TIME  ANY  PERSON  BOARDS  THE  AIRCRAFT 
WITH  THE  INTENTION  OF  FLIGHT  UNTIL  SUCH  TIME  AS  ALL  SUCH  PLRSONS  HAVE 
DISEMBARKED.  IN  WHICH  ANY  PERSON  SUFFERS  DEATH  OR  SERIOUS  INJURY  AS  A  RESULT 
OF  BEING  IN  OR  UPON  THE  AIRCRAFT  OR  BY  DIRECT  CONTACT  WITH  THE  AIRCRAFT  OR 
ANYTHING  ATTACHED  THERETO,  OR  THE  AIRCRAFT  RECEIVES  SUBSTANTIAL  DAMAGE . 


“FATAL  INJURY*  MEANS  ANY  INJURY  THAT  RESULTS  IN  DEATH  WITHIN  50  DAYS. 


"HULL  LOSS"  MEANS  DAMAGE  DUE  TO  AN  ACCIDENT  THAT  WAS  TOO  EXTENSIVE  TO  REPAIR. 
UR  THAT,  FOR  ECONOMIC  REASONS,  THE  AIRCRAFT  WAS  NOT  REPAIRED  AND  RETURNED 
TO  SERVICE. 
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The  air  carrier  jet  fleet  has  grown  to  a  figure  of  over  6500  aircraft  and  has  amassed 
nearly  189  million  flight  hours  involving  some  136  million  departures.  The  accident 
rate  has  steadily  decreased  until  the  early  70's  when  a  leveling  of  the  rate  began  and 
has  remained  essentially  the  same  since  that  time  (Reference  1) .  A  careful  examination 
of  the  last  decade  is  necessary  to  determine  where  the  concentration  of  efforts  must  be 
applied  in  order  to  further  reduce  the  present  rate. 

DISCUSSION 

The  world  air  carrier  jet  fleet  total  accident  rates  and  fatal  accident  rates  are 
shown  in  Figure  2. 


ACCIDENT  RATE  WORLD-WIDE  JET  FLEET 

FICURE  } 

This  figure  illustrates  the  significant  improvement  of  accident  rates  since  the  early 
days  of  air  carrier  jet  operation  until  the  early  1970's  when  a  lessening  of  this 
decreasing  rate  began  and  continues  at  the  present  time.  For  comparative  purposes,  plots 
of  all  accidents  are  shown  along  with  those  of  fatal  accidents.  As  would  be  expected, 
the  trends  are  similar. 

Hull  losses  for  the  same  time  period  are  shown  in  Figure  3. 


V) 


HULL  LOSS  RATES  AIR  CARRIEP  JET  FLEET 


FIGURE  3. 
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The  similarity  between  fatal  accident  rates  and  hull  loss  rates  is  illustrated  in 
Figure  4. 


so 


YEAR 


COMPARISON  OF  HULL  LOSS  &  FATAL  ACCIDENT  RATE 

FIGURE  4 


It  is  clearly  shown  that  in  today's  air  carrier  get  fleet,  a  hull  loss  accident  will 
probably  be  a  fatal  accident.  The  flattening  of  these  rate  curves  could  lead  one  to 
conclude  that  we  are  at  a  point  where  further  significant  gains  will  not  be  made  and  that 
continued  expenditure  of  funds  for  safety  improvement  will  produce  little  effect.  To 
dispel  this  theory,  we  will  examine  the  costs  of  accidents. 

Hull  losses  can  amount  to  50  or  60  millions  of  U.S.  dollars  for  a  modern  jet  transport 
and,  when  combined  with  the  expenses  of  damaged  parts  and  liability  costs,  become  an  im¬ 
portant  consideration  for  an  operator.  In  Figure  5  we  see  that  in  spite  of  the  fatal 
accident/hull  loss  rate  being  stabilized  at  a  fairly  low  level,  the  cost  of  an  accident 
has  continued  to  rise  at  an  alarming  rate,  emphasizing  the  need  for  better  safety  manage¬ 
ment  of  today's  sophisticated  equipment  (Reference  2). 


1975  78  77  78  79  90  81 


YEAR 

ESTIMATED  ACCIDENT  COSTS 
WORLD  JET  FLEET 

FIGURE  9. 


Continuing  our  overview  of  the  air  carrier  jet  accident  history,  Figure  6  is  a  geo¬ 
graphic  depiction  of  hull  losses.  The  years  1975  and  1980  were  chosen  since  they  fall 
within  the  past  ten  year  period  of  fairly  constant  accident  rates.  In  general,  all 
areas  of  operation  reflect  improvement  with  significant  rate  reductions  in  Asia,  Africa 
and  Central  and  South  America  although  these  three  geographic  areas  continue  to  experi¬ 
ence  the  highest  hull  loss  rates. 
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EUROPE  A8IA  AFRICA  CENTRAL  -US  8  CANADA 
8  S. A .  S.  PACIFIC 


AIR  CARRIER  HULL  LOSS  RATE 


To  complete  our  statistical  review,  we  will  consider  the  phases  of  operation  where 
these  losses  are  occurring  and  the  associated  cause  factors.  In  Figure  7  we  see  that 
for  the  22  year  time  period  over  half  the  accidents  have  occurred  in  about  14  percent 
of  the  operational  exposure  time  which  is  made  up  of  initial  approach,  final  approach 
and  landing.  It  further  shows  that,  of  these  accidents,  nearly  40  percent  occur  in 
the  final  approach  and  landing  phases  which  account  for  only  4  percent  of  the  exposure 
time.  This  means  that  when  the  next  accident  occurs,  it  is  probable  that  it  will 
happen  on  or  near  a  major  airport  and,  according  to  U.  S.  National  Transportation  Safety 
Board  statistics  on  U.  S.  jet  air  carriers,  the  probability  of  a  post  crash  fire  in 
what  would  otherwise  be  a  survivable  accident  is  also  likely. 


HULL  LOSS  ACCIDENTS  1960-1981 


FIGURE  7. 


Figure  7  also  suggests  that  if  further  improvements  are  achieved  in  the  latter  phases 
of  a  flight,  these  same  improvements  are  likely  to  affect  the  initial  phases  of  flight 
(takeoff) ,  initial  climb  and  climb)  which  could  improve  the  rates  of  these  phases  which 
account  for  about  30  percent  of  the  accidents  in  12  percent  of  the  exposure  time. 


4-5 


The  final  statistical  chart,  Figure  8,  shows  the  causal  factors  involved  in  the  22 
years  of  accident  statistics.  The  percentages  are  approximate  however  they  too  have 
remained  essentially  the  same  for  the  past  decade. 


WORLD  JET  AIR  CARRIER  FLEET 
1960  -  1981 

CAUSE  FACTORS  IN  FATAL  ACCIDENTS 


COCKPIT  CREW 

70  -  75% 

AIRFRAME, POWERPLANTS,  SYSTEMS 

13% 

MAINTENANCE 

3% 

WEATHER 

5% 

AIRPORT, ATC 

flOURE  0 

4% 

The  human  element,  presented  here  as  cockpit  crew,  has  continued  to  be  the  predomi¬ 
nant  causal  factor.  The  airframe,  powerplants,  systems  and  maintenance  aspects  have 
reached  a  much  higher  degree  of  reliability  but  of  course  must  not  be  ignored  where 
safety  improvements  are  considered. 

WHERE  DO  WE  GO  FROM  HERE? 

One  of  the  difficulties  in  reviewing  the  voluminous  data  regarding  the  jet  fleet 
accidents  for  over  20  years  is  synthesizing  this  information  into  a  form  on  which  posi¬ 
tive  actions  can  be  taken.  Analyzing  the  details  of  each  accident,  although  important 
from  the  standpoint  of  providing  an  immediate  remedial  action  for  what  went  wrong,  is 
not  treated  in  this  presentation.  Rather,  a  search  for  a  commonality  in  these  accidents 
is  attempted. 

The  stabilization  of  the  accident  rates  and  causal  factors  in  the  last  ten  years 
have  shown  that  there  is  really  nothing  new  in  commercial  jet  accidents  (Reference  3) . 

In  1972  the  U.S.  NTSB  conducted  a  special  forum  on  approach  and  landing  accident  pre¬ 
vention  at  which  some  35  papers  were  presented  on  this  subject  (Reference  4) .  in  1976 
the  Flight  Safety  Foundation  devoted  their  entire  conference  to  the  subject  at  their 
29th  Annual  International  Air  Safety  Seminar  in  Anaheim,  California.  The  problems  were 
recognized  early  in  the  development  of  these  trends  therefore  this  presentation  can 
only  re-emphasize  and  discuss  what  has  been  done  and  what  remains  to  be  done. 

SAFETY  MANAGEMENT 

The  role  of  the  manager  in  safety  improvement  cannot  be  overstressed.  The  cost  of 
equipment  and  the  related  liabilities  make  it  imperative  that  the  aircraft  and  its 
operating  environment  be  treated  as  a  system  with  emphasis  on  maintaining  high  skill 
levels  in  every  aspect  which  affects  safe  handling  and  operation.  The  designer  also 
must  assure  that  all  equipment  involved  in  this  system  reflect  considerations  of  the 
human  factor  to  prevent  misuse  and  subsequent  failure  to  produce  the  desired  level  of 
safety. 

The  need  for  safety  management  at  all  levels  has  been  demonstrated  vividly  in  recent 
years  when,  in  Pakistan,  a  DC-10  which  was  receiving  hangar  maintenance,  was  destroyed 
by  fire  when  cleaning  solvent  which  was  being  used  in  the  proximity  of  a  titanium  bolt 
grinding  operation  was  ignited  by  sparks.  Fire  extinguishers  were  not  immediately 
available  and  the  hangar  deluge  system  did  not  work.  A  DC-8  and  a  DC-9  were  also  con¬ 
sumed  in  separate  occurrences  by  oxygen  system  fires  during  maintenance.  These  occurred 
in  Europe  and  Canada  respectively.  Although  hangar  and  ramp  fires  do  not  usually  result 
in  fatalities,  the  cost  to  the  operator  can  be  significant. 

At  the  other  end  of  the  spectrum  was  the  Turkish  DC-10  which  crashed  in  France  in 
1974  due  to  the  improper  latching  of  a  cargo  door.  Three  hundred  forty-five  occupants 
were  killed  making  this  one  of  the  worst  disasters  in  commercial  aviation  history. 
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COMMUNICATION 

There  are  many  accidents  in  which  a  causal  factor  was  the  lack  of  communication 
(Reference  5).  Air  New  Zealand's  Flight  901  is  a  classic  example.  This  was  the  DC-10 
which  crashed  on  the  slopes  of  Mt.  Erebus  in  November  1979  killing  all  257  occupants. 
Although  the  investigating  board  cited  many  factors  which  led  to  the  catastrophe,  the 
airline  had  changed  the  computerized  flight  track  of  the  aircraft  and  had  not  notified 
the  flight  crew  of  this  action. 

The  Trans  World  Airlines  Boeing  727  which  crashed  on  approach  to  Dulles  Airport  out¬ 
side  Washington  D.C.  involved  as  a  causal  factor  the  lack  of  proper  communication  between 
the  cockpit  and  air  traffic  control,  resulting  in  a  premature  descent.  The  92  occupants 
were  killed. 

The  prompt  and  accurate  transfer  of  information  extends  beyond  the  cockpit.  It 
involves  all  aspects  associated  with  the  operation  of  aircraft  including  maintenance, 
air  traffic  control  and  training  of  both  flight  crews  and  cabin  attendants. 

Communication  within  an  aviation  organization  is  certainly  important  but  it  is  only 
one  part  oe  the  effort.  Information  must  be  constantly  transferred  between  organizations 
and  betweer  countries.  This  is  particularly  important  to  countries  which  have  not  yet 
amassed  th,->  experience  which  has  been  acquired  by  other  operators.  They  should  not  have 
to  learn  by  (_■■■  ir  own  accidents  what  is  already  known  to  other  operators. 

This  transfer  of  experience  can  be  accomplished  in  many  ways.  The  Aviation  Safety 
Reporting  System  (ASRS)  is  one  system  utilized  in  the  U.S.  which  accommodates  the  anony¬ 
mous  reporting  of  unsafe  practices  or  occurrences.  It  is  a  system  by  which  trend  analyses 
can  be  conducted  so  that  remedial  actions  can  be  taken  and  the  system  includes  monthly 
newsletters  in  which  selected  reports  are  published  for  the  information  of  those  who  are 
interested . 

Seminars  and  conferences  are  another  means  of  information  transfer.  This  Flight 
Mechanics  Panel  of  AGARD  is  a  prime  example  as  are  the  annual  Safety  Seminars  sponsored 
by  the  Flight  Safety  Foundation.  In  order  to  continue,  these  types  of  meetings  must 
receive  domestic  and  international  support. 

WEATHER 

Weather  continues  to  be  a  causal  factor  in  many  of  our  accidents  and  in  recent  years 
considerable  emphasis  has  been  placed  on  the  effects  of  wind  shear.  A  three-year  program 
has  been  initiated  which  will  attempt  to  determine  the  efforts  of  low-level  wind  shear 
performance,  test  and  evaluate  wind  shear  detection  and  warning  systems  and  will  extend 
the  usefulness  of  Doppler  radars  for  detecting  conditions  of  which  pilots  and  the  public 
need  to  be  warned.  This  program  is  the  Joint  Airport  Weather  Studies  Project  (JAWS) .  It 
is  a  cooperative  effort  between  the  United  States  and  Great  Britain. 

Also  the  Australian  Department  of  Defence  has  recently  completed  a  survey  of  652 
military  and  civilian  Australian  pilots  and  air  traffic  controllers  to  gather  specific 
information  on  operational  aspects  of  windshear  (Reference  6) .  Information  gathered 
through  efforts  such  as  these  should  assist  in  reducing  accidents  involving  this  phenome¬ 
non. 


The  importance  of  ground  deicing  was  dramatically  demonstrated  in  the  1982  Air  Florida 
accident  in  the  Potomac  River  in  Washington  D.C.  Although  many  causal  factors  were  in¬ 
volved,  resulting  in  11  reccommendations  by  the  National  Transportation  Safety  Board  to 
the  Federal  Aviation  Administration,  the  lack  of  standards  for  ground  airframe  deicing 
was  of  primary  interest.  This  was  another  instance  of  an  old  problem  not  receiving  ade¬ 
quate  attention  until  after  a  major  disaster. 

GROUND  PROXIMITY  WARNING  SYSTEMS  (GPWS) 

The  extensive  use  of  GPWS  has  been  a  major  safety  improvement  in  commercial  aviation. 
Since  1975,  when  GPWS  began  to  be  extensively  used,  there  has  been  approximately  a  45* 
reduction  in  accidents  involving  controlled  flight  into  terrain. 

Presently,  21*  or  about  1300  of  the  world's  commercial  turboprop  and  jet  aircraft 
have  not  been  equipped  with  GPWS.  Several  countries  including  Canada,  Finland,  Greece 
and  Spain  do  not  require  the  use  of  these  systems.  Continued  emphasis  is  necessary  to 
encourage  the  installation  and  use  of  these  systems. 

ACCIDENT  INVESTIGATION 


Afuerithe  fact  information  which  is  developed  from  accident/incident  investigations 
wia?h^-80lKte  nefesftty  to  prevent  future  similar  occurrences.  The  need  for  accuracy 
and  thoroughness  in  these  activities  cannot  be  overemphasized  and,  again,  the  information 
gained  must  be  promptly  disseminated  on  a  world-wide  basis  as  promptly  as  possible. 

..  The  increased  sophistication  of  the  modern  jet  transport  makes  the  investigation  of 
these  accidents  more  and  more  difficult  without  some  previously  recorded  data  such  as 
that  provided  by  Flight  Data  Recorders  (FDR)  and  Cockpit  Voice  Recorders  (CVR) .  Increas¬ 
ing  the  amount  of  data  recorded  could  serve  not  only  as  an  improved  record  of  crash 
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information  but  could  be  used  for  maintenance  trends  and  proficiency  evaluations  which 
provide  operational  cost  savings  and  could  be  used  to  detect  trends  which  could  be 
useful  in  accident  prevention. 

TERMINAL  AREA  CLEANUP 

Many  of  today's  airports  are  still  in  need  of  improved  runway  approaches,  overruns 
and  shoulders  which  provide  freedom  from  obstructions. 

Accidents  which  have  involved  these  factors  might  well  have  been  incidents  or  minor 
accidents  had  major  structural  damage  not  been  done  by  ditches,  roadways  or  abrupt  terrain 
elevations  adjacent  to  the  landing  surface. 

TRAINING  AND  CREW  QUALIFICATIONS 

Large  quantities  of  information  have  been  developed  on  this  subject  over  the  years, 
however,  it  must  be  continuously  emphasized.  Periodic  review  and  updating  of  pilot 
rating  requirements  must  be  conducted.  Psychological  examinations  for  screening  crew 
applicants  must  be  put  into  effct  as  more  information  is  gathered  in  this  area.  New 
techniques  for  training  also  must  be  put  into  use  in  the  form  of  simulators  and  other 
computer  techniques. 

ANTI-MISTING  KEROSENE  (AMK) 

Many  landing  accidents  have  resulted  in  fatalities  when  post-crash  fires  occur,  pre¬ 
venting  the  rapid  egress  of  the  occupants.  When  there  is  no  fire  there  is  unlimited 
time  for  orderly  egress  when  no  injuries  due  to  the  crash  itself  have  occurred  (Refer¬ 
ence  7)  . 

The  AMK  program,  which  is  being  jointly  pursued- by  the  United  States  and  Great  Britain 
could  provide  a  major  break-through  in  preventing  post-crash  fires  and  fatalities.  A  full 
scale  remotely  controlled  crash  test  involving  a  Boeing  707  is  planned  for  this  year  in 
the  Mojave  Desert.  The  aviation  community  is  anxiously  awaiting  the  results  of  this  test. 

CONCLUSIONS 

Although  the  jet  air  carrier  accident  rate  has  appeared  to  stabilize  at  a  low  level 
for  the  past  decade,  it  must  not  be  interpreted  that  there  is  nothing  more  to  be  done 
in  safety  in  the  operation  of  these  aircraft. 

•  Even  if  the  accident  rate  remains  the  same  for  the  coming  decade,  the  costs 
of  these  accidents  will  probably  continue  to  increase  dramatically. 

•  Techniques  which  have  proven  successful  in  achieving  the  present  low  accident 
must  be  continually  emphasized  and  improved  as  technology  permits.  In  addi¬ 
tion,  new  safety  technology  must  be  applied  as  it  is  developed. 

•  Human  factors,  in  all  facets  of  aviation,  continues  to  be  a  predominant 
aspect  in  accident  prevention  and  in  this  regard,  the  prompt  and  accurate 
transfer  of  information  is  continually  important. 
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EXECUTIVE  SUMMARY 

""The  rationale  for  aviation  incident  reporting  systems  is  presented  and  contrasted 
to  some  of  the  shortcomings  of  accident  investigation  procedures.  The  history  of  the 
United  State's  Aviation  Safety  Reporting  System  (ASRS)  is  outlined  and  the  program's 
character  explained.  The  planning  elements  that  resulted  in  the  J^RS  program's 
voluntary,  confidential,  and  non-punitive  design  are  discussed.  Immunity,  from 
enforcement  action  and  misuse  of  the  volunteered  data,  is  explained  and  evaluated. 
Report  generation  techniques  and  the  ASRS  data  analysis  process  are  described;  in 
addition,  examples  of  the  ASRS  program's  output  and  accomplishments  are  detailed. 
Finally,  the  value  of  incident  reporting  for  the  acquisition  of  safety  information, 
particularly  human  error  data,  is  explored.. 


BACKGROUND 

Man’s  intelligence  and  technology  have  worked  toward  a  goal  of  greater  system 
safety.  As  a  consequence,  the  aviation  industry  has  witnessed  vastly  improved 
aircraft,  avionics,  air  traffic  control  equipment,  and  ground-based  facilities.  As 
the  hazard  profile  of  these  "hardware"  elements  has  diminished,  the  reality  of  the 
presence  and  magnitude  of  human  error  as  a  causal  factor  in  accidents  has  been 
indelibly  impressed  on  those  agencies,  organizations,  and  individuals  vested  with  the 
responsibility  for  minimizing  the  risks  associated  with  aviation  operations. 

Aircraft  accidents  are  frequently  caused  or  severely  aggravated  by  human  error. 
In  tracing  the  chain  of  causation  of  these  accidents,  safety  investiqators  and 
researchers  have  been  generally  effective  in  determining  the  "what"  of  the  event,  but 
they  are  not  as  effective  in  addressing  the  "why"  of  the  event.  The  "why"  of  an  event 
very  often  involves  the  human  factors  associated  with  that  mishap.  Unfortunately,  the 
nature  of  accidents  results  in  several  significant  problems  in  the  investigation  of 
human  performance  issues. 

First,  and  fortunately,  accidents  are  rare  events;  consequently,  the  investigator 
or  researcher  is  provided  with  relatively  few  data  points  to  study  and  from  which  to 
draw  insight. 

Second,  it  is  an  unfortunate  truism  that  pilots  are  usually  the  first  at  the 
scene  of  aircraft  accidents;  they  are  often  unable  to  be  of  much  help  after  the  smoke 
clears . 

Third,  in  a  litigious  society,  concepts  of  legal  and  financial  liability 
effectively  distort  or  hinder  the  investigation  process.  Even  if  a  crewmember 
survives  the  accident,  the  potentially  staggering  consequences  of  an  admission  of 
error  frequently  thwart  timely  and  accurate  fact-finding. 

Because  of  these  problems  the  investigation  of  aircraft  accidents  is 
characterized  by  a  "post  hoc"  reasoning  process,  often  using  incomplete  facts,  in  an 
effort  to  determine  a  plausible  chain  of  causation.  The  factual  findings  and 
determination  of  probable  causes  resulting  from  this  reasoning  process  are  subject  to 
inaccuracies  and  may  or  may  not  yield  reliable  data  useable  in  pursuit  of  enhanced 
system  safety;  this  is  particularly  true  with  regard  to  human  error  data. 

The  three  problems  cited  above  are  not  present  in  a  confidential,  incident 
reporting  system.  Compared  to  accidents,  incidents  occur  frequently.  Pilots  and 
crewmembers  survive  incidents,  albeit  sometimes  with  difficulty,  and  are 
characteristically  willing  to  share  the  experience  in  the  presence  of  assurances  of 
protection.  Finally,  since  the  vast  majority  of  incidents  do  not  result  in  any 
liability  the  threat  of  adverse  legal  or  financial  consequences  is  usually  not 
present. 


Safety  investigators  have  long  been  aware  of,  anti  concerned  about,  the 
monotonously  repetitive  pattern  of  human  failure  characteristic  of  accident 
statistics.  This  awareness  and  concern  has  been  particularly  well-developed  within 
the  aviation  community.  Many  attempts  have  taken  place  over  the  past  decades  to 
obtain  comprehensive  information  concerning  operational  problems  in  aviation, 
particularly  in  the  case  of  those  events  that  fortunately  fell  short  of  beinq 
accidents.  One  of  the  responses  to  this  need  for  more  and  better  information 
concerning  operational  and  human  error  problems  has  been  the  implementation  of 
incident  reporting  systems.  The  history  of  aviation  incident  reporting  systems  can  be 
traced  back  to  the  early  1940' s;  the  idea  is  not  a  new  one.  However,  despite  the 
anticipated  potential  of  incident  reporting  programs,  the  desired  productivity  has  not 
materialized;  this  is  primarily  due  to  the  fact  that  many  contributors  were,  and  are, 
hesitant  to  describe  their  own  errors  and  misconceptions,  especially  to  an  authority 
which  has  the  power  to  discipline  or  economically  penalize  the  reporter. 

In  recognition  of  the  need  for  more  and  better  information  concerning  operational 
and  human  problems  in  the  United  State's  National  Aviation  System,  the  federal 
Aviation  Administration  in  May,  1975,  implemented  an  Aviation  Safety  Reporting  Proqram 
(ASRP),  whose  purpose  was  to  improve  the  flow  of  information  of  possible  significance 
to  air  safety  investigations  and  research.  To  encourage  the  submission  of  reports, 
the  agency  offered  a  limited  waiver  of  disciplinary  action  to  those  who  provided 
timely  information  concerning  incidents,  and  to  others  involved  in  those  incidents, 
unless  the  occurrences  involved  a  criminal  offense,  an  aircraft  accident,  reckless 
operation,  willful  misconduct  or  gross  negligence. 

Notwithstanding  the  FAA's  promise  that  information  reported  under  the  ASRP 
program  would  not  be  used  against  the  provider  of  the  data,  it  soon  became  obvious 
that  there  were  misgivings  in  the  aviation  community  regarding  the  regulatory  and 
enforcement  agency's  rple  in  the  collection  and  use  of  the  often  sensitive  incident 
data.  For  that  reason,  the  FAA  asked  the'  National  Aeronautics  and  .  Space, 
Administration  (NASA),  an  independent  research  organization  without  regulatory  or 
enforcement  authority,  to  act  as  a  “third  party"  in  the  program.  NASA  was  requested 
to  design  a  modified  incident  reporting  program  and  to  take  over  responsibility  for 
the  receipt,  processing,  analysis  and  deident i f icat ion  of  those  aviation  incident 
reports.  In  addition  to  its  ability  to  fulfill  the  role  of  a  disinterested 
intermediary,  NASA  saw  a  unique  benefit  to  its  research  capability  deriving  from 
ongoing  access  to  the  human  factors  data  generated  by  an  incident  reporting  system. 
NASA  accepted  the  FAA's  proposal;  the  Aviation  Safety  Reporting  System  (ASRS)  beqan 
operations  on  April  15,  1976. 


CHARACTERISTICS  OE  THE  SYSTEM 

The  designers  of  the  ASRS  had  as  their  objective  an  incident  reporting  system 
that  would  have  the  characteristics  of  utilization,  utility,  and  effectiveness. 
Essentially,  the  mission  was  to  design  and  operate  a  system  that  the  community  trusted 
and  with  whom  it  would  communicate;  in  addition  that  system  had  to  be  capable  of 
constructively  using  the  data  received,  and  the  program's  product  had  to  be  reflected 
in  effective  applications  within  the  aviation  system. 

The  objectives  of  NASA's  ASRS  program  are  as  follows: 

-  To  make  available  a  confidential  reporting  system  which  can  be  used  by  any 
person  in  the  national  aviation  system. 

-  To  operate  a  computer-based  system  for  storage  and  retrieval  of  processed 
data . 

-  To  provide  an  interactive  analytical  system  for  routine  and  special 
studies  of  the  data. 

-  To  maintain  a  responsive  system  for  communication  of  data  and  analyses  to 
those  responsible  for  aviation  safety. 

The  basic  statement  of  purpose  of  the  program  can  be  found  in  the  ASRS  Memorandum 
of  Agreement  between  NASA  and  the  FAA  ...  "This  system  will  be  designed  primarily  to 
provide  information  to  the  FAA  and  the  aviation  community  to  assist  the  FAA  in 
reaching  its  goal  of  eliminating  unsafe  conditions  and  preventing  avoidable 
accidents".  More  specifically,  the  purpose  of  the  ASRS  program  has  been  defined  as: 

Identifying  deficiencies  and  discrepancies  in  the  national  aviation  system 

to  provide  a  knowledgeable  basis  for  improving  the  current  aviation  system; 

and  providing  data  for  planning  and  improvements  to  future  systems. 

In  an  age  of  information  and  communication,  the  acquisition  of  safety  data 
regarding  aviation  incidents  should  not  present  a  significant  challenge  to  proqram 
planners  and  managers;  and  in  fact,  most  members  of  the  aviation  community  have 
historically  exhibited  a  willingness  to  share  information,  especially  about  accidents. 
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hardware,  and  other  partys*  actions.  However,  the  mission  of  the  Aviation  Safety 
Reporting  System  is  to  obtain  incident  data  provided  by  the  participants  in  those 
events;  more  specifically,  the  ASRS  database  is  designed  to  reflect  the  participant's 
assessment  of  the  situation  or  occurrence  and  his  or  her  role  in  that  condition. 
Other  information  systems  exist  to  assemble  descriptive,  statistical,  or  second  and 
third-party  data;  but  the  ASRS  mandate  involves  the  task  of  gathering  analytical 
first-party  data,  especially  information  that  addresses  the  "why"  of  an  event  as 
reflected  in  the  behavior  exhibited  by  the  participants. 

The  first  step  toward  satisfaction  of  the  ASRS  mandate  was  to  design  a  system  in 
which  the  aviation  community,  both  individually  and  collectively,  could  place  a  high 
degree  of  trust;  furthermore,  that  trust  from  the  community  needed  to  be  matched  by 
consistent  credibility  on  the  part  of  the  ASRS  program  and  the  program's  management. 
It  was  decided  that  the  elements  of  trust  and  credibility  could  be  best  served  by  an 
incident  reporting  system  that  was  voluntary  and  promised  total  confidentiality. 

While  mandatory  reporting  systems  may  produce  greater  quantities  of  data,  the 
quality  of  data  from  such  systems  may  suffer  from  superficiality  and  doubt  on  the  part 
of  the  report  source  as  to  its  ultimate  use.  Voluntary  information  systems,  on  the 
other  hand,  have  usually  been  characterized  by  higher  quality  reporting  from 
individuals  motivated  by  a  genuine  desire  to  see  an  issue  pursued  beyond  the 
" f il 1 ing-in-the-blanks"  phase  of  safety  investigation.  Ry  providing  the  motivated 
volunteer  with  the  equally  important  assurance  of  absolute  confidentiality,  the  ASRS 
design  accommodates  both  the  researcher’s  need  for  quality,  comprehensive  data  and  the 
reporter's  desire  for  selectivity  and  anonymity. 

One  of  the  major  attributes  of  the  ASRS  program  is  its  cooperative  nature.  Since 
the  inception  of  the  ASRS,  a  vital  degree  of  oversight  and  guidance  has  been  provided 
by  virtually  every  segment  of  the  aviation  community.  The  result  of  this  cooperation 
is  the  existence  of  an  incident  reporting  system  that  is  viewed  as  a  safety 
information  resource  to  be  utilized  by  all  elements  of  the  aviation  oommunity. 

Of  equal  importance  to  the  elements  of  voluntariness  and  confidentiality  is  the 
lack  of  an  enforcement  mandate  in  the  charter  of  the  organization  vested  with  the 
responsibility  for  the  incident  reporting  program  administration,  data  analysis  and 
information  management.  This  consideration  made  the  selection  of  the  National 
Aeronautics  and  Space  Administration  a  logical  one  in  the  search  for  a  disinterested 
third-party.  NASA's  role  as  third-party  intermediary  between  the  members  of  the 
aviation  community  and  the  Federal  Aviation  Administration  has  often  been 
characterized  as  that  of  an  "honest  broker"  attending  to  the  best  interests  of  both 
s ides . 

A  collateral  issue  to  the  design  of  a  system  which  encouraged  voluntary  incident 
reporting  was  that  of  immunity  for  those  individuals  electing  to  report  to  the  ASRS. 
The  issue  of  immunity  is  bifurcated.  Immunity  protection  can  apply  to  the  use  of  the 
data  obtained,  in  which  case  the  issue  is  termed  "use  immunity";  by  the  same  token, 
immunity  protection  can  refer  to  the  shielding  that  the  individual  obtains  from 
disciplinary  action  in  exchange  for  his  or  her  information;  this  is  referred  to  as 
"transactional  immunity".  In  conjunction  with  the  NASA  pledge  of  confidentiality  for 
report  sources,  the  FAA  offered  both  forms  of  immunity  to  contributors  to  the  ASRS 
program.  The  first,  use  immunity,  was  established  in  the  form  of  promises  contained 
in  the  FAA  Advisory  Circular  and  the  FAA/NASA  Memorandum  of  Agreement  which  set  forth 
that  "...  FAA  will  not  seek  and  NASA  will  not  release  to  the  FAA  any  information  that 
might  reveal  the  identity  of  [persons  filing  reports  and  persons  named  in  those 
reports]".  The  concept  of  use  immunity  was  further  strengthened  in  1979  with  the 
implementation  of  Federal  Aviation  Regulation  #91.57  which  states: 

The  Administrator  of  the  FAA  will  not  use  reports  submitted  to  the  National 

Aeronautics  and  Space  Administration  under  the  Aviation  Safety  Reporting 

Program  (or  information  derived  therefrom)  in  any  enforcement  action,  except 

information  concerning  criminal  offenses  or  accidents  which  are  wholly 

excluded  from  the  Program. 

To  a  large  degree  use  immunity  and  confidentiality  are  intertwined;  in  the 
context  of  the  ASRS  program  neither  of  these  two  basic  elements  has  been  altered  or 
even  challenged  by  any  party  to  the  system. 

From  the  beginning  of  the  ASRS  program  in  April  of  1976,  the  issue  of  reporter 
protection  from  enforcement  actions,  transactional  immunity  or  the  "waiver  of 
disciplinary  action",  has  been  a  point  of  contention.  Although  not  specifically 
requested  by  the  aviation  community  in  the  1975-1976  period,  the  waiver  of 
disciplinary  action  was  offered  by  the  FAA  as  an  element  of  the  ASRS  concept. 

It  should  be  noted  at  this  point  that  the  waiver  of  disciplinary  action 
associated  with  ASRS  incident  reporting  has  always  been  viewed  by  NASA  as  an  issue 
between  the  FAA  and  the  aviation  community.  While  recognizing  it  as  an  element  of  the 
overall  ASRS  concept,  NASA,  which  has  no  authority  to  pursue  enforcement  actions  or 
grant  any  immunity  from  them,  has  essentially  taken  an  observer  position  on  the  issue 
of  transactional  immunity. 


The  original  waiver  of  disciplinary  action  that  accompanied  the  ASRS  in  April  of 
1976  remained  in  force  until  July  1,  1979.  Following  a  period  of  controversy  over  the 
need  for  the  existence  of  transactional  immunity  for  ASRS  reporters,  the  waiver  of 
disciplinary  action  was  modified  to  reflect  the  current  provisions  as  set  forth  in  FAA 
Advisory  Circular  00-46B: 

The  filing  of  a  report  with  NASA  concerning  an  incident  or  occurrence 
involving  a  violation  of  the  Act  or  the  Federal  Aviation  Regulations  is 
considered  by  the  FAA  to  be  indicative  of  a  constructive  attitude.  Such  an 
attitude  will  tend  to  prevent  future  violations.  Accordingly,  although  a 
finding  of  a  violation  may  be  made,  neither  a  civil  penalty  nor  certificate 
suspension  will  be  imposed  if: 

(1)  The  violation  was  inadvertent  and  not  deliberate; 

(2)  The  violation  did  not  involve  a  criminal  offense,  or  accident,  or  action 
under  Section  609  of  the  Act  which  discloses  a  lack  of  qualification  or 
competency,  which  are  wholly  excluded  from  this  policy; 

(3)  The  person  has  not  been  found  in  any  prior  FAA  enforcement  action  to 
have  committed  a  violation  since  the  initiation  of  the  ASRP  of  the  Federal 
Aviation  Act  or  of  any  regulation  promulgated  under  that  Act;  and 

(4)  The  person  proves  that,  within  10  days  after  the  violation,  he  or  she 
completed  and  delivered  or  mailed  a  written  report  of  the  incident  or 
occurrence  to  NASA  under  ASRS. 

Transactional  and  use  immunities  have  become  a  primary  cons iderat ion  in  the  ASRS 
concept.  It  is  conceivable  that  a  successful  incident  reporting  system  could  be 
launched  without  transactional  immunity,  but  use  immunity  is  essential. 

Reports  containing  information  relating  to  aviation  accidents  (as  defined  by 
National  Transportation  Safety  Board  Regulation  830.2)  and  criminal  activities  (as 
codified  in  Title  10  of  the  U.S.  Code,  Annotated)  are  exempt  from  both  the  immunity 

and  confidentiality  provisions  of  the  ASRS  program.  Because  the  ASRS  and  its  staff 

members  can  not  be  above  the  law  in  the  sense  of  withholding  accident  or  criminal 
information,  all  such  information  is  forwarded  to  the  appropriate  investigatory  bodies 
and  not  retained  in  the  ASRS  database.  It  should  be  noted  that  the  individuals  who 
have  submitted  the  reports  of  accidents  or  criminal  activity  are  notified  after  the 
data's  receipt  of  the  requirement  placed  on  the  ASRS  to  forward  the  information  to  the 
proper  federal  agency;  this  courtesy  is  extended  primarily  to  let  the  person  know  what 
happened  to  the  data;  it  is  also  done  to  explain  the  loss  of  immunity  and 
confident ia 1 ity . 

Two  coincidental,  but  different  categories  of  motivation  prompt  contributors  to 
the  ASRS  program  to  report  their  experience.  The  first  <  itegory,  direct  personal 
advantage  through  confidentiality  and  immunity,  has  already  been  discussed.  The 
second,  enhanced  system  safety,  is  a  product  of  what  the  ASRS  staff  does  with  the  data 
that  has  been  volunteered.  In  essence  this  issue  simply  requires  ASRS  to  recognize 

that  it  must  achieve  and  feed-back  program  results,  otherwise  the  majority  of  data 

submitters  will  stop  seeing  value  in  program  participation  and  not  report  thei, 
experiences . 

Feedback  to  the  aviation  community  can  be  both  direct  and  indirect.  The  most 
immediate  response  to  the  reporter  community  is  the  direct  feed-back  nrovided  to  the 
reporter  following  submission  of  an  ASRS  report.  Few  frustrations  match  that  of 
voluntarily  submitting  data  derived  from  personal  experience  to  a  governmental  body 
which  has  been  requesting  such  data,  and  then  not  having  that  contribution 
acknowledged.  Immediately  upon  deidenti f icat ion  of  each  ASRS  report  form  the 
individual  who  submitted  that  report  is  provided,  by  return  mail,  with  the  following: 

-  The  Identification  Strip  section  of  the  ASRS  report  form,  date-stamped  and 
bearing  the  internal  tracking  number  for  that  I.D.  strip;  in  addition, 
where  possible,  ASRS  analysts  are  encouraged  to  add  a  short,  personal  note 
to  each  I.D.  strip  from  reports  they  have  worked; 

-  Two  blank  ASRS  Reporting  Forms  to  replace  the  one  submitted  to  ASRS: 

-  A  letter  of  appreciation  to  the  reporter  for  his  or  her 
contribution  to  the  ASRS  program; 

-  A  copy  of  the  current  issue  of  Ca 1 1  back ,  the  ASRS's  informal  safety 
publication.  This  enclosure  not  only  passes  on  safety  information,  it 
also  exhibits  the  ASRS's  capability  for  constructive  data  usage  and  timely 
dissemination  of  contributed  data. 


This  direct  return  response  is  accomplished  within  days,  usually  no  more  than 
four  or  five,  of  the  date  of  receipt  of  the  report  at  the  ASRS  offices.  Not  only  has 
the  reporter  received  the  I.D.  strip  for  immunity  purposes,  he  or  she  is  also  made 
immediately  aware  of  the  report's  receipt,  data  usage,  and  acknowledgement  of  the 
government's  appreciation  for  his  or  her  efforts  and  concern  in  pursuit  of  enhanced 
aviation  safety. 

The  indirect  feed-back  to  the  reporter  community  takes  the  form  of  evidence  of 
data  usage  through  Alert  Bulletins,  periodic  technical  reports,  the  ASRS's  monthly 
safety  publication  Callback ,  and  awareness  of  the  community's  ability  to  access  the 
ASRS  database  for  legitimate  safety  investigations  and  research.  In  other  words,  the 
individual  reporters,  and  their  professional  organizations  or  trade  associations,  are 
made  aware  of  the  fact  that  useful  information  is  coming  out  the  production  end  of  the 
ASRS  process  in  a  timely  fashion. 


THE  REPORT  ANALYSIS  PROCESS 

In  the  seven  years  of  its  existence,  the  ASRS  has  received  more  than  34,hdn 
reports;  human  errors  can  be  found,  and  confessed  to,  in  more  than  7(1  percent  of  these 
reports.  Most  reporters  are  frank  to  admit  to  their  own  mistakes,  and  will  go  into 
detail  in  describing  the  circumstances,  character,  and  outcome  of  the  incident. 
Contributors  to  the  ASRS  seem  to  genuinely  care  about  their  role  in  an  event  and  take 
pains  to  report  actions,  emotions,  and  perceptions  accurately  in  the  face  of  often 
critical  circumstances.  We  have  been  impressed  with  the  care  and  effort  put  into  the 
writing  of  most  of  the  reports  while  at  the  same  time  we  have  lamented  the  lack  of 
detail  in  a  few  others,  some  of  which  described  possibly  serious  potential  problems. 
We  have  thought  that  many  reports  were  probably  trivial  in  terms  of  any  impact  on 
safety  -  until  later,  when  it  became  clear  that  reports  which  appear  trivial  in 
isolation  can  help  to  point  to  an  underlying  factor  of  real  importance.  The  ASRS 
staff  is  frank  to  admit ‘tha't  we  are  unable  to  characterize  a  "trivial"  report,  for  in 
concert  with  other  reports,  it  may  assist  in  understanding  a  genuine  problem.  Many 
reports  stand  as  monuments  to  the  dedication  of  their  authors  to  aviation  safety;  some 
of  the  best  are  reprinted  in  full,  after  de ident i f icat ion,  in  ASRS  program  reports. 

ASRS  reports  are  received  and  processed  daily  by  members  of  the  ASRS  staff.  The 
reports  are  read  by  an  attorney  who  has  a  background  in  aviation  law  and  aviation 
safety.  If  they  involve  criminal  acts,  they  are  transmitted  in  identified  form  to  the 
U.S.  Department  of  Justice  for  investigation.  If  they  refer  to  an  aircraft  accident, 
they  are  forwarded,  identified,  to  the  National  Transportation  Safety  Board-  If,  in 
the  NASA  reviewer's  opinion,  they  contain  time-critical  safety  data,  they  are  singled 
out  for  priority  handling.  The  reports  are  then  forwarded  by  bonded  courier  to  the 
ASRS  program  contractor's  office  for  analysis. 

The  ASRS  program  managers  made  an  early  decision  to  use  the  services  of  a 
civilian  contractor  to  assist  in  the  design  and  management  of  the  ASRS  program. 
Following  the  usual  competitive  procurement  process,  Battel le  Memorial  Institute's 
Columbus  Laboratories  was  selected  as  the  ASRS  program  contractor.  Battel le  has 
established  a  base  of  operations  for  ASRS  activity  adjacent  to  NASA's  Ames  Research 
Center,  thereby  allowing  for  quick  and  easy  communications  between  NASA's  ASRS 
management  and  the  program's  contractor,  who  is  now  responsible  for  the  majority  of 
ASRS  report  processing  and  database  research. 

The  reports  are  given  to  analysts,  each  of  whom  is  an  expert  in  the  area  of  air 
traffic  control,  general  aviation  or  air  carrier  operations.  The  analysts  study  the 
reports,  and  decide  whether  further  direct  contact  with  the  reporters  is  necessary  or 
desirable.  If  so,  they  initiate  such  "callbacks"  by  telephone.  Callbacks  have  the 
unique  advantage  of  increasing  the  rapport  between  reporter  and  analyst,  while  at  the 
same  time  enhancing  the  post-event  learninq  and  analysis  process  for  both  parties. 
Thereafter,  or  if  further  contact  is  not  desired,  they  remove  the  identification 
strips;  the  strips  are  logged  out  by  serial  number  and  returned  to  reporters  with  a 
new  report  form. 

By  the  time  the  reports  have  passed  through  the  initial  analysis  phase,  all 
identifying  information  contained  in  the  original  report  has  been  removed.  This 
deident if icat ion  process  includes  the  removal  and  return  of  the  reporter’s 
identification  strip;  in  addition,  any  individual  or  company  name,  as  well  as  any 
aircraft  names  or  numbers,  are  deleted  from  the  report  and  appropriate  substitutions 
entered  in  their  place. 

Analysts  study  the  information  provided  by  reporters  either  in  their  reports  or 
in  subsequent  contacts.  If  they  believe  that  a  report  contains  time-critical  safety 
data,  it  becomes  the  basis  for  dissemination  of  an  Alert  Bulletin.  They  may  augment 
the  information  provided  in  the  report  by  constructing  or  adding  charts  or  other 
graphic  material.  They  are  not  permitted  to  verify  or  refute  the  information  provided 
by  a  reporter  through  contact  with  other  persons;  the  ASRS  mandate  prohibits  this,  and 
the  System's  resources  do  not  permit  investigation  of  reported  incidents. 


Analysts  then  add  to  the  reporter's  narrative  a  synopsis,  their  analytic  comments 
and  informal  notes.  It  should  be  noted  that  when  ASRS  reports  are  analyzed  and 
evaluated  an  attempt  is  made  to  discern  both  human  and  system  factors  associated  with 
the  reported  event  or  situation.  It  is  often  impossible  to  attribute  cause  and  effect 
relationships  to  such  factors;  although  it  is  usually  possible  to  categorize  various 
factors  as  having  an  "enabling"  or  "associated"  relationship  to  the  chain  of 
causation.  In  addition  to  coding  these  enabling  and  associated  factors,  the  analysts 
also  determine  and  code  the  "recovery"  factors  involved  in  the  event,  thereby 
recording  their  analysis  of  the  reasons  this  event  was  an  incident  and  not  an 
accident.  The  analysts  code  the  report  to  incorporate  data  describing  the  attributes 
of  the  occurrence;  descriptive  and  diagnostic  terms  are  added  as  a  final  step.  The 
entire  package  is  then  checked  by  a  second  reviewer-analyst  for  completeness  and 
prepared  for  computer  entry. 

Typists  transfer  each  report  package  to  magnetic  tape;  the  tapes  are  copied  and 
sent  to  a  computer  facility  where  they  are  read  onto  disk  files  for  storaqe.  The 
information  management  system  which  houses  the  ASRS  data  is  Battel le's  Automated 
Search  Information  System  (BASIS).  BASIS  is  a  very  effective,  flexible  analytic  tool 
for  large  bodies  of  free  text  and  coded  data.  Report  narratives,  synopses  and 
analyses  are  entered  in  the  computer  in  free  text  format.  A  substantial  number  of 
coded  entries  describing  each  report  is  also  available;  these  entries,  along  with  the 
descriptors  and  diagnostic  terms,  are  indexed  and  are  therefore  readily  available  as 
search  terms. 


SYSTEM  OUTPUT  AND  ACCOMPLISHMENTS 

The  ASRS  program’s  output  has  two  basic  functions.  The  first  is  to  notify  the 
FAA  and  the  aviation  community  of  the  existence  of  alleged  hazards  in  the  system.  The., 
second  function  is-  to  attempfco- provide  "art  Explanation  for  the  presence  of  hazard 
conditions;  essentially  an  attempt  to  achieve  an  understanding  of  the  "why"  of  certain 
conditions  or  situations. 

The  ASRS  is  capable  of  disseminating  data  in  several  ways.  The  output  of  the 
program  to  date  consists  of: 

-  More  than  770  Alert  Bulletins  -  time-critical  notices  from  the  ASRS  to 
persons  or  organizations  in  a  position  to  effectively  investigate,  and 
possibly  cure,  an  alleged  hazard  reported  to  the  ASRS. 

-  464  special  data  requests  -  responsive  database  searches  requested  of  the 

ASRS  by  the  FAA,  NTSB,  and  other  members  of  the  aviation  community. 
Requested  studies  vary  from  the  simple  to  the  extremely  complex: 

responsive  searches  have  ranged  from  a  few  database  statistics  to  lengthy 
studies . 

14  Program  Reports  -  periodic  publications  containing  samples  of 
constructive  deidentified  reports  received  by  the  ASRS,  selected  Alert 
Bulletins  and  the  responses  to  them,  and  one  or  more  reports  on  research 
studies  performed  by  the  project  staff.  The  fifteenth  program  report  is 
currently  in  preparation. 

-  11  Research  Reports  and  Technical  Papers  -  single  topic  research  reports 

dealing  with  aviation  safety  problems;  addressing  primarily  human  factors 
issues,  these  reports  have  dealt  with  subjects  such  as  fatigue, 

information  transfer  problems,  controlled  flight  toward  terrain,  cockoit 
distraction,  and  altitude  deviations. 

-  47  monthly  safety  publications  -  Callback .  an  easy-to-read  one-page 
newsletter  designed  for  the  light,  but  timely,  expression  of  safety  issues 
relevant  to  the  entire  aviation  community. 

The  products  of  ASRS  data  usage  are  distributed  to  the  aviation  community  by 
several  means  order  to  publicize  the  uses  and  value  of  the  incident  reporting 

system.  ASRS  Procri.m  Reports  are  supplied  to  over  40,000  individuals  through  company 
or  organizational  distribution  channels,  direct  mailings  from  a  list  maintained  by  the 
ASRS  staff,  and  through  the  National  Technical  Information  Service.  Technical  and 
Contractor  Reports  are  distributed  by  direct  mail  from  a  recipient  list  created  and 
maintained  by  the  ASRS  staff.  The  Cal lback  publication  is  provided  to  any  member  of 
the  aviation  community  who  has  expressed  to  the  ASRS  office  a  desire  to  be  placed  on 
the  mailing  list  for  that  publication.  Finally,  special  requests  for  deidentified 
information  from  the  ASRS  database  are  available  to  the  aviation  community  for 
legitimate  safety  investigations,  research,  and  training  activities. 
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In  addition  to  the  ASRS  products  cited  above,  the  incident  reportinq  system  has 
been  a  key  source  of  data  for  several  aviation  safety  review  bodies  which  have 
assisted  in  the  formulation  of  national  aviation  policy.  Extensive  incident 
information  was  supplied  from  the  ASRS  database  for: 

-  The  President's  Task  Force  on  Aircraft  Crew  Complement 

-  The  National  Institutes  of  Health  Select  Panel  on  Mandatory  Pilot 
Retirement 

-  The  Flight  Safety  Foundation's  Air  Traffic  Control  Evaluation  Task  Force 

-  The  Air  Traffic  Control  Association  Review  and  Analysis  of  Air  Traffic 
Control  Terminal  Area  Operations 

-  The  National  Transportation  Safety  Board's  Review  of  the  U.S.  Air  Traffic 
Control  System 

Non-documentable  and  intangible  contributions  to  safety  constitute  a  second  class 
of  program  accomplishments  from  the  ASRS.  ASRS  has  significantly  improved 
communication  among  the  various  segments  of  the  aviation  community,  including  FAA, 
DOD,  NTSB,  and  NASA.  All  elements  of  the  community  have  worked  together  on  the 
system;  all  have  used  its  data  in  the  pursuit  of  solutions  to  safety  problems.  The 
common  database  has  made  it  possible  to  reach  consensus  on  some  issues;  in  other 
cases,  it  has  permitted  more  rational  and  focussed  advocacy  by  the  proponents  of 
differing  points  of  view.  In  several  cases  involving  national  aviation  policy,  ASRS 
has  been  virtually  the  only  source  of  incident,  as  opposed  to  accident,  data.  There 
is  no  other  similar  database,  and  there  is  considerable  doubt  whether  one  could  be 
accumulated  under  different  ground  rules. 

While  there  appears  to  be  no  effective  means  of  measuring  the  impact  of  ASRS  data 
in  the  field  of  aviation  education  and  training,  it  is  known  that  there  has  been 
widespread  use  of  ASRS  material  by  flight  instructors,  flight  schools  and  air  carrier 
training  facilities,  as  well  as  military  training  and  safety  organizations.  The 
contents  of  the  ASRS  program's  research  publications  and  Cal lback ,  the  monthly  safety 
bulletin,  are  frequently  reproduced  in  airline,  flightcrew,  and  military  safety 
education  publications. 

Among  the  subtleties  of  the  impact  of  ASRS  activities  on  system  safety  is  that  of 
moral  suasion  for  the  purpose  of  leverage.  It  is  not  an  uncommon  occurrence  for  a 
request  to  be  made  of  the  ASRS  staff  to  provide  data  or  a  publication  to  support  a 
legitimate  safety  improvement  that  is  on  the  verge  of  acceptance  but  needs  a  litMe 
extra  push.  Because  of  the  depth  of  information  in  the  ASRS  database,  particularly 
human  error  data,  and  because  of  the  program's  credibility  within  the  aviation 
community,  ASRS  alert  bulletins  and  research  data  have  been  used  to  achieve  safety 
objectives  in  need  of  impartial  support.  This  use  of  ASRS  product  has  been  evident  in 
actions  and  communications  instituted  by  elements  of  the  community,  the  military,  and 
governmental  agencies. 

One  of  the  important  benefits  of  incident  reporting  to  a  program  like  ASRS  takes 
place  before  the  report  ever  reaches  the  program  office.  Program  participants  have 
expressed  the  notion  that  the  act  of  having  to  organize  and  express  the  relevant  facts 
and  issues  associated  with  a  given  event  or  situation  has  proven  to  be  an  extremely 
valuable  learning  experience  for  the  reporter.  Because  of  the  program’s  assurances  of 
confidentiality,  reporters  have  often  gone  beyond  a  basic  recitation  of  the  facts  to 
probe  their  own  motivations,  misconceptions,  proficiency,  and  other  considerations 
that  may  have  contributed  to  the  the  factors  that  made  up  the  incident.  The  event 
analysis  and  performance  critique  that  takes  place  at  both  ends  of  the  reportinq 
process  is  clearly  a  significant,  but  unmeasureable ,  benefit  of  the  ASRS  program. 

The  most  obvious,  as  well  as  the  most  undocumentable,  category  of  ASRS 
achievements  is  the  element  of  accidents  avoided  and  deaths  prevented.  It  is 
impossible  to  document  a  non-event.  However,  given  the  array  of  research,  alert 
bulletins,  publications  and  assistance  offered  and  utilized  as  a  result  of  ASRS 
operations,  it  seems  reasonable  to  assert  that  the  presence  and  products  of  the  ASRS 
have  prevented  accidents  and  saved  lives. 


Summary 

When  you  want  to  know  more  about  an  occurrence,  or  why  a  person  did  what  they  did 
in  the  course  of  events,  the  best  approach  seems  to  be  to  simply  ask  the  participants. 
First-hand  experiental  input  is  not  a  foolproof  method  of  data  acquisition.  It  is 
subject  to  the  biases  and  fears  of  the  reporter;  but  it  is  usually  better  than 
interrogation  of  witnesses  and  non-participants,  or  second-quessing .  It  is  our 
experience  that  a  voluntary,  confidential,  non-punitive  incident  reportinq  system  is  a 
logical  and  effective  means  of  acquiring  unique  data,  as  well  as  supplementing  data 
generated  by  conventional  accident  investigation  techniques  and  other  system 
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monitoring  programs.  A  properly-structured  incident  reporting  system's  great 
advantage  is  that  it  has  the  strength  and  the  means  to  ask,  and  frequently  answer,  the 
question  "why?"  whenever  one  is  confronted  with  a  "what".  There  is  no  substitute  for 
knowing  why  a  system  failed  or  a  human  erred.  If  we  understand  why  things  happen,  we 
may  be  able  to  prevent  them  from  happening  again  or  at  least  protect  the  participants, 
or  the  system,  from  the  consequences  of  subsequent  events.  The  potential  for 
constructive  uses  of  incident  data  seems  to  be  especially  promising  in  the  field  of 
human  behavior;  incident  reporting  is  a  tool  which  permits  the  cooperative  examination 
of  human  behavior  in  complex  systems,  using  data  supplied  directly  by  the  participants 
in  that  system.  ASRS  activities  and  research  have  been  oriented  toward  issues 
associated  with  the  role  of  the  human  in  the  operational  aspects  of  aviation.  The 
program's  structure  and  principles  have  permitted  the  ASRS  to  compile  an  extensive 
body  of  incident  data;  more  specifically,  the  assurances  of  confidentiality  and  the 
availability  of  transactional  immunity  have  resulted  in  the  creation  of  a  large  and 
comprehensive  human  factors  database  for  use  by  aviation  investigators,  researchers, 
planners  and  policy-makers  throughout  the  world. 

The  success  of  the  Aviation  Safety  Reporting  System  in  the  United  States,  and  the 
international  emergence  of  programs  similar  to  ASRS,  support  the  position  that 
incident  reporting  in  other  nations  and  other  disciplines  can  be  effective  in 
achieving  a  better  understanding  of  system  deficiencies  and  human  error. 
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Cile  Air  I  ranee 

‘J5500  Roissy  Aeroporl  Charles  de  (»aulle 
I  ranee 


I.  INTRODUCTION 


f. 'analyse  system.it  ique  des  vols  par  lecture  des  enreq  istrements  de  par  airn-tres  est  prutiquee  a  la  Cnmpaame 
AIR  1' RANCH  depuis  pr»'S  de  dix  ins. 

ELLe  constitue  l 'une  des  bases  de  la  Politique  de  Prevention  des  Accidents  dont  ll  nous  a  paru  utile  de 
rappeler  les  concepts  fomlament aux . 

Apr-  s  an  bref  hist^rique,  seront  rupidement  exposes  les  moyens  mis  en  place,  les  moth ode 5  et,  surtout,  la 
"philosophic"  qui  a  conduit  a  1 'etabl issement  d’un  "Pcotocole"  dont  1 ' uppl icat ion  riqoureuse  a  permis  d'ob- 
tenir  1 'adhesion  et  la  participation  des  equipaqes. 

Seront  ensuite  exjKar.es  les  pnncipes  de  f onct  lonnement 

-  de  la  "Commission  d'Analyse  des  Vols"  charade  d'examiner  les  dossiers  les  plus  siqm  f  lcatifs 

-  de  la  "communicat ion  unonyme"  destinee  a  recueillir  aupros  de  l'equipaqe,  suns  qu'il  soit 
necessaire  d’identifier  celui-ci,  les  informations  compldmenta l res  utiles  a  la  Commission. 

Enfin,  seront  presenters  quelques  uns  des  pnneipaux  resultats  obtenus  qrace  a  1 'Analyse  systematise  des 
Vols. 


II.  POLITIQUE  DE  PREVENTION  DES  ACCIDENTS  -  CONCEPTS  FONDAMENTAUX 


2.1.  -  Interactions  Homme  Much i no  Environnement 

a)  Les  incidents  ou  anomalies  de  vol  sont  ‘jener  ulement  causes  |>ar  une  defaillance  de  1  '  Homme , 
de  la  Machine  ou  par  un  facteur  defuvorable  de  1 ' Env i ronhement . 

b)  L ' accident  est  rarement  le  resultat  d'une  simple  cause.  11  est  qeneralement  le  resultat  de 
la  con]onction  de  facteurs  ap>partenant  a  plusicurs,  voire  a  1 'ensemble,  de  ces  principaux 
domaines  qui  constituent  une  chainc  d  '  evonemen ts  . 

c)  Par  suite  de  1 'evolution  rupide  de  la  technolome,  1' interface  Homme /Machine  mdrite  une  at¬ 
tention  part icul i ore . 

2.2.  -  Nature  des  accidents 

a)  Cbacun  des  facteurs  ayant  contribuc  a  un  accident  a  qeneralement  deja  ete  ldentifie  dans  des 
incidents  precedents,  isolement  ou  dans  une  combi nai son  differente. 

b)  Chaque  facteur  peut  avoir,  dans  la  chaine  des  evenements,  un  role  determinant  dans  la  yravite 
du  resultat  final.  11  suffit,  en  effet,  de  la  presence  d’un  seul  d’entre  eux  |>our  faire  la  dif 
ference  entre  1' incident  et  l 'accident. 

2.3.  -  Relation  entre  nombre  d' incidents  et  probability  d* accident 

II  y  a  relation  entre  le  nombre  d'incidents  et  la  probability  d'accident,  ainsi  qu’entre  la  fre¬ 
quence  des  differents  types  d 'evenements  et  leur  qravite. 

2.4.  -  Interet  de  checcher  a  diminuer  le  nombre  d'incidents  meme  mineurs  et  d'etendre  le  domaine  d'inves 

ti gat  ion  a  toute  anomalie. 

Ces  relations  entre  nombre  d'incidents  et  probability  d'accident  peuvent  etre  illustrees  schema- 
tiquement  par  une  pyramide  dont  la  base  serait  const itueo  par  ips  incidents  mineurs  et  le  sommet 
par  1 'accident. 

Si  on  admet  par  exemple,  que  |x>dr  3(X)  incidents  ll  y  a  une  probability  de  30  incidents  majeurs 
pouvant  eux-memes  conduire  a  un  risque  serieux  d'accident,  le  fait  de  diminuer  le  nombre  des  inei 
dents  reduira  la  probability  d'occurrence  des  incidents  majeurs  et,  de  la  le  risque  potentiel 
d'accident. 


Le  principe  fondamental  de  la  Prevention  des  Accidents  repose  done  sur  1 ' invest igat ion  approfondi 
de  tout  incident  mais  egalement  sur  1 'elarqissement  du  domaine  d ’ invest iqation  a  toute  anomalie 
sur venue  en  vol  pour  pouvoir  reduire  la  base  de  la  "pyramide". 


Le  premier  stade  do  la  I’rovontion  dos  Accidents  est 1 'etablissement  de  normes  de  certification  des 
ivions,  la  definition  d'une  rog lement at  ion  de  Sexploitation  et  du  niveau  des  licences  equipage. 


Coei  est  effectue  on  fonction  de  certaines  hypotheses,  done  a  priori.  II  convient  decertifier  ces 
hypotheses  dans  les  conditions  do  realisation  des  vols,  e'est-a-dire  en  fonction  de  l'environne- 
men  t  techno  log  i  que ,  operat ionnel  et  humain  et,  surtout,  en  fonction  de  I'evolution  de  celui-ci. 

Cent  1 'object  if  du  Controle  et  de  la  Surveillance  de  Sexploitation  qui  permet  de  detecter  et 
‘i'evaluer  tout  incident,  ano.nalie  ou  difficulte  et,  par  son  action  a  posteriori,  de  fermer  la  l>oucle 
de  Prevention  des  accidents  tunt  a  1‘ inter leur  de  la  Compagnie  elle-meme  que  bien  en  amont,  aupres 
du  eonstr ucteur ,  voire  des  admin i strat ions  chargees  d'etublir  les  normes  de  cert i f icat ion  ou  de 
definir  la  roglement at  ion. 

Nous  verrons  qu*en  ce  domuine,  1 'analyse  systematigue  des  enregistrements  de  parametres  de  vol  peut 
jouer  un  role  fondamental . 


HI.  COMP AR A l  SON  DES  DEUX  PR  1  fiC  I  PALES  SOURCES  D '  1  NFORMAT  1 OM 


3.1.  Rapoort  equipage 

t.e  principal  moyen  d'avoir  connaissancc  des  incidents  ou  anomalies  en  vol  etait,  jusqu'aLors,  le 
rapport  des  equipages. 

Les  incidents  lies  a  une  panne  ou  anomalie  de  fonct lonnement  du  materiel  sont  bien  connus  car  faisant 
l'objet  de  comptes  rendus  des  mecaniciens  navigants  etablis  apres  chaque  vol  et  exploites  par  les 
services  d'entretien.  Ce  systeme  fonct ionne  bien. 

Par  centre,  on  constate  que  les  incidents  de  caractere  operationnel  qui  impliquent  davantage  des  hommes 
facilement  ident i f i. abler,  —  equipages  ou  controleurs  de  la  circulation  aerienne  —  ne  sont  pas  tou jours 
connus . 

Les  raisons  en  sont  multiples  : 

-  Tout  d'abord,  1' equipage  peut  avoir  ignore  1' incident  ;  par  exemple  s'il 
survole  le  relief  avec  des  moyens  insuffisants  en  vol  aux  instruments, 
ou  s'il  est  victime  d'une  illusion  d'optique  en  vol  a  vue. 

-  II  peut  egalement  arriver  qu'il  sous-estime  1' importance  de  l'anomalie 

ou  l'interet  de  la  rapporter  parce  qu'il  la  considere  comme  un  cas  isole. 

-  II  peut  aussi  considerer  que  son  rapfx^rt  risque  de  ne  pas  etre  exploite. 

-  II  pout  craindre  de  se  trouver  implique,  voir  sa  reputation  engagee. 

Hien  des  gens  pensent  qu'il  est  difficile  de  reconnoitre  des  erreurs, 
meme  vis-a-vis  de  soi . 

II  leur  est  done  encore  plus  difficile  de  rapporter  des  erreurs  a  la 
compaqnie  qui  les  emploie,  ou  1 'administrat ion  qui  leur  delivre  la  licence. 

-  II  peut  craindre,  enfin,  de  mettre  en  cause  d'autres  prof ess ionnels  de 
1 '  aviation . 

11  existe  un  moyen  susceptible  de  procurer  des  informations  extremement  interessantes  :  ll  s'agit  des 
enregistreurs  de  parametres  de  vol  installes  a  bord  des  avions  pour  faciliter  les  enquetes  en  cas 
d ' accident . 

3.2.  Enregistrements  de  parametres 

Ceux  qui  equipent  les  avions  modernes  permettent  de  reconst ituer  les  tra jectoires ,  de  connaitre  la 
configuration  avion,  le  deroulement  du  vol,  ainsi  gue  les  principaux  parametres  de  fonct ionnement  des 
moteurs . 

Leur  utilisation  systematique  par  les  compaqnies  se  heurte  a  deux  obstacles  :  le  cout  de  l’operation 
et  les  reticences  des  equipages. 

Or,  certains  resultats  de  cette  utilisation  mteressent  l'entretien  des  avions  et  de  leurs  equipements, 
et  ceci  peut  contribuer  a  rentabiliser  les  1 nvest i ssements  necessaires  en  materiel  et  en  personnel.  En 
effet,  la  possibility  de  connaitre  de  nombreux  parametres,  en  partveulier  ceux  concernant  les  moteurs, 
et  le  fait  que  les  releves  de  vol  etablis  par  les  mecaniciens  navigants  peuvent  manquer  de  precision  en 
cas  de  variations  rapides  ou  etre  incomplets  car  il  est  difficile  de  noter  plusieurs  parametres  en  meme 
temps,  a  suscite  un  tres  grand  interet  de  la  part  des  services  d'entretien  pour  1 'uti 1 isat ion  des  enre¬ 
gistreurs  de  vol. 


Reste  la  reticence  des  equipages.  Celle-ci,  qui  repose  pr incipalement  sur  la  crainte  de  sanctions,  se 
manifeste  dans  toutes  les  compaqnies  de  tous  les  pays,  ce  qui  explique  qu'a  ce  jour  "1* ana  lyse  des  vols" 
a  l 'aide  des  enregistrements  est  assez  peu  pratiquee.  Une  grande  compagnie  aerienne  a  tente,  il  y  a 
quelgues  annees,  de  faire  admettre  par  1 ' administrat ion  de  son  pays  et  par  ses  equipages  la  creation 
d'un  tel  systeme,  ce  qui  aurait  permis  en  particulier  la  suppression  d'un  des  deux  controles  annuels  en 
vol  reglementaires  pour  les  pilotes,  mais  l'entreprise  a  bute  sur  la  difficulte  de  determiner  les  tole¬ 
rances  de  pilotage  acceptees  par  tous  et  a  du  etre  abandonnee. 
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Dans  quelques  compagnies  europeennes  il  est  cependant  possible  de  pratiquer  of f iciellement  1* analyse  des 
vols.  C'est  le  cas  de  la  compaqnie  AIR  FRANCE  qui  utilise  systematiquement  depuis  pres  de  dix  ans,  avec 
le  plein  accord  des  representants  des  Organisat ions  Professionnelles  du  Personnel  Navigant  Technique,  les 
enreqistreurs  de  vol  pour  obtenir  des  informations  sur  les  conditions  dans  lesquelles  se  deroule  l'ex- 
ploitation,  dans  le  cadre  d'un  protocole  qui  en  definit  les  modal ites  de  fonctionnement . 


IV.  PROTOCOLE  ENREG l STREUR 

Les  principes  fondamentaux  de  ce  protocole,  signe  le  24  avril  1974,  sont  les  suivants  : 

1.  -  1 'analyse  systematique  des  enregistrements  doit  se  faire  de  fa^on’ strictement  anonyme 

2.  -  elle  ne  doit  pas  etre  utilisee  pour  devaluation  des  performances  indi viduelles 

3.  -  elle  ne  peut  conduire  a  la  prise  de  sanctions  a  l'encontre  des  equipages  (si  l'anomalie  n'a 

pas  entratne  d' incident  ca  n'a  pas  ete  revelee  par  une  autre  source) 

4.  -  participation  des  representants  des  organisations  Professionnelles  aux  travaux  d' analyse 

des  vols  au  sein  d'une  Commission. 

Les  anomalies  (cas  d 'analyse  des  vols)  ne  sont  plus  examinees  par  un  Chef  Pilote,  mais  par  une  Commis¬ 
sion  reqroupant  un  grand  norabre  de  cadres  PNT  et  dont  nous  examinerons  la  composition  plus  loin. 


V.  HISTORIQUE  DE  "l'aNALYSE  DES  VOLS"  ET  MOYENS  MIS  EN  PLACE 


Jusqu'en  1974,  les  enregistreurs  des  parametres  de  vol  utilisaient,  pour  la  plupart,  des  supports 
photograph igues  permettant  1 'enregistrement  d'un  nombre  reduit  de  parametres  (10  parametres). 

L1 analyse  des  enregistrements  se  limitait  alors  aux  incidents  et  se  faisait,  en  ce  qui  concerne  le 
domaine  operat ionnel ,  directement  par  la  Division  de  Vol  par  examen  visuel. 

Ce  type  d 'analyse  se  trouvait  forcement  lim’te.  II  a  ete  exploite  pour  les  Caravelle,  B.727  et  B.707. 

L' importance  du  reseau  AIR  FRANCE  (300  a  400  etapes  de  vol  par  jour)  et  la  decision  de  proceder  a 
L* analyse  systematique  de  tons  les  vols  ont  necessity  la  mise  en  place  de  moyens  relativement  impor- 
tants  en  materiel  et  en  personnel. 

II  fut  procede,  en  1974,  a  la  creation  d'un  Service  centralise,  independant  des  Divisions  de  vol,  rat- 
tache  directement  au  Directeur  des  Operations  Aeriennes,  et  place  sous  1 'autorite  de  1 'Off icier  de 
Security  des  Vols. 

Cet  organisme,  appele  Service  Securite  et  Analyse  des  Vols,  est  charge  de  promouvoir  une  politique  de 
prevention  des  accidents,  l'analyse  systematique  des  informations  enregistrees  etant  un  des  prmcipaux 
moyens  mis  a  sa  disposition. 

L'obl igation  faite  par  1‘Arrete  du  28  mai  1975  d'equiper  les  avions  certifies  apres  le  30  novembre  1969 
d'un  enregistreur  magnetique  d’accident,  capable  d 'enregistrer  un  nombre  beaucoup  plus  eleve  de  para¬ 
metres,  a  permis  d’envisager  une  utilisation  beaucoup  plus  elargie. 

Outre  sa  capacite  plus  importante  (60  a  90  parametres)  1 '  interet  d'un  enregistrement  magnetique  digital 
est  qu'il  peut  etre  soumis  directement  a  un  traitement  par  ordinateur  apres  lecture.  II  a  ete  decide  de 
proceder  a  1 ' instul lat ion  d’un  deuxieme  enregistreur  a  cassette  d'une  autonomie  d 'enregistrement  de 
50  heures  appele  PMR  (Performance  Maintenance  Recorder),  1 'enregistreur  d 'accident  n 'etant  pas  adapte 
de  par  son  autonomie  et  les  difficultes  d'acces  a  1 'enregistrement  (incorpore  et  a  boucle  fermee) . 

11  a  done  ete  con^u  un  systeme  capable  de  detecter  automat iquement  certains  ecarts  par  rapport  a  un 
profil  de  vol  standard,  ou  d 'alerter  l'exploitant  sur  la  possibility  d'une  anomalie  quelconque. 


Un  premier  systeme  appele  SYDAS  a  ete  mis  en  place  en  1976.  Sa  capacite  est  maintenant  insuf f isante . 
Orace  a  1 'experience  acquise  par  1 'ut i 1 isat ion  de  ce  premier  systeme,  il  a  ete  possible  de  realiser  un 
systeme  plus  complet,  plus  elabore  et  plus  nor  formant  :  1^  systeme  CARINE  "Chalne  d 'Analyse  et  de 
Restitution  des  Informations  Enregistrees"  qui  sera  mis  en  exploitation  courant  1983. 
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VI .STRUCTURE  DE  LA  CHAINE  DE  TRAI TEMENT  DES  ENREGI STREURS 


Le  systeme  CARINE  comprend,  essent iellement  : 


-  une  unite  centrale  composee 

.  d’un  nuni-ordinateur  Cl  I  Honeywell  Bull  -  modele  92  de  la  gamme  Mini  6 
d’une  capacite  memoire  de  1  Mo. 

.  d'une  memoire  tambour  de  512  Mo, 

.  d'une  unite  de  mini-disques  de  8  Mo, 

.  d'une  console  de  commande. 


-  un  ensemble  d 'entree  permettant 

.  la  lecture  des  cassettes  PMR  (Performance  Maintenance  Recorder)  et 
.  la  lecture  des  enregistreurs  d'accident  DFDR  (Digital  Flight  Data  Recorder) 
au  truvers  d'un  synchromsateur , 

.  la  saisie  des  donnees  d ' ident if ication  des  e tapes  par  liaison  IBM  ; 


-  un  ensemble  de  sortie  comprenant 

.  une  unite  d 'enregistrement  sur  hande  magnetique  pour  les  stat istiques, 
.  une  imprimante, 

.  trois  ecrans  graphiques, 

.  une  table  tra^ante. 


VII.  DEROULEMENT  DU  TRA I TEMENT 


Con^u  comme  un  outil  d'aide  aux  per  •r.r.els  charges  de  1 'analyse  des  vols  (exploi  tants ) ,  le  systems 
CARINE  effectue  un  traitement  gue  !'  »n  schemat iquement  decomposer  en  quatre  phases  : 

-  une  phase  automat lque, 

-  une  phase  manuelle, 

-  une  phase  dite  "conversat ionnelle" , 

-  une  phase  finale  de  constitution  du  dossier  denomme  "Cas  d ’analyse  des  Vols”, 


et  qui  per met  d  'assurer  les  principales  fonctions  suivantes  : 

1 .  En  PHASE  AUTOMAT I  CUE  : 

.  lecture  et  traduction  des  informations  enregistrces  (cassette  PMR), 

.  identification  des  etapes, 

.  classement  des  etapes  selon  la  classification  : 

1  :  etap« sans  anomalie, 

2  :  etapesavec  anomalie(s)  probable (s), 

3  :  eta|>es  avec  anomalie(s)  certaine(s), 

.  stockaqe  sur  mim-disque  des  etapes  de  classe  2  et  classe  3  pour  traitement 
ulter icur , 

.  releve  et  stockaqe  des  donnees  pour  traitements  stat istiques , 

.  edition  d'un  etat  dit  "Etat  d 'anomal ies” . 


2.  En  PHASE  MANUELLE,  l'exploitant  intervient  ['our 


.  examiner  l'Etat  >1*  anomalies, 

.  evaluer  les  anomalies  en  fonction  de  l ’onvironnement  operationnel  afin 
de  ]uger  de  la  nature  et  de  1 ' im|x>r tance  des  anomalies. 


A  ce  stade,  l'exploitant  juge  de  la  {joursuite  ou  non  de  1' analyse  de  chaque  cas  detecte  en 
phase  automat ique. 
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3.  En  PHASE  CONVERSATIQNNELLE ,  1 ' exploi. tant  precede  a  une  analyse  plus  approfondie  a  l'aide  de  l'ecran 
graphique  qui  lux  permet  de  visuuliser  1 'ensemble  de  la  phase  de  vol  concernee  (parametres,  trajec- 
toires)  pour  determiner 

-  le  degre  de  gravite  de  l'anomalie, 

-  le  choix,  la  disposition,  l'echelle  des  courbes  de  parametres,  des  trajectoires  et  des 
t rofils  destines  a  la  constitution  du  dossier. 

Cet  ecran  permet  egalement  d'apporter  des  renseignements  suppiementaires  et  d'eliminer  des  elements 
super f lus. 


4*  En  PHASE  FINALE  de  constitution  du  dossier  d1 ANALYSE  DES  VOLS 

1 'exploitant  procede  a  1* impression  sur  papier  de  1 'ensemble  des  informations  qu'il  a  selectees  sur 
l'ecran  graphique  et  constitue  le  dossier  dit  "Cas  d’analyse  des  vols"  qui  comprend  : 

-  le  dossier  des  donnees  operat ionnelles , 

-  des  extraits  des  manuels  d ' Exploi tat  ion  et  d ' Util isat ion  rappel  ant  les  procedures  et 
les  consignes  concernees, 

-  un  etat  de  parametres, 

-  eventuel lement ,  une  trajectoire  et  un  profil  de  vol. 


VIII.  EXPLOITATION  DU  DOSSIER  "CAS  D'ANALYSE  DES  VOLS" 


8.1. 


par  l'Officier  de  Securit 


Les  dossiers  de  cas  d’ Analyse  des  vols  sont  soumis  regul lerement  a  l'Officier  de  Securite  des 
Vols  qui  les  examine  et  retient  ceux  qui  feront  l'objet  d'une  presentation  en  Commission  d'Ana- 
lyse  des  Vols  —  les  autres  etant  conserves  a  des  fins  statistiques  ou  adresses  directement,  pour 
information,  a  1 'equipage  concerne. 

II  peut,  en  vue  de  completer  certains  dossiers,  decider  d'interroger  les  equipages  concernes 
par  le  systcme  de  Communication  Anonyme  afin  d'obtenir  des  renseignements  complementaires  sur 
les  circonstances  et  eventuellement ,  les  causes  auxquelles  les  equipages  attribuent  les  anoma¬ 
lies  relevees  par  l 'analyse  des  vols. 


8.2.  La  Communication  Anonyme 

Destinee  a  completer  un  dossier  d’analyse  des  vols,  la  demande  de  renseignements  aupres  de  1 'equi¬ 
page  concerne  se  doit  de  respecter  le  prmcipe  d'anonymat  du  Protocole. 


bans  ce  but,  le  dossier,  dont  les  parametres  d ' ident i f icat ion  du  vol  non  necessaires  a  la  comprehension 
du  cas  sont  supprimes,  est  reproduit  en  trois  exemplaires  (1  exemplaire  pour  chacun  des  membres  de 
1 'equipage  technique)  inseres  dans  une  enveloppe  cachetee  adressee  a 


Monsieur  le  Commandant 


du  vol  . (n°  du  vol) 

du  . (date) 


Cette  enveloppe  est  transmise  au  Chef  du  Service  Technique  du  Centre  de  Vol  concerne  qui,  apres  consul¬ 
tation  du  planning,  la  placera  dans  le  easier  du  Commandant  ayant  effectue  le  vol. 

Cette  procedure  respecte  done  strictement  l'anonymat  ;  en  effet  : 

-  l'Officier  de  Securite  des  Vols  connait  les  faits,  mais  ne  connait  pas  J'identite  de 
1 ’equipage, 

-  le  Chef  du  Service  Technique  connait  le  nom  du  Commandant,  mais  ignore  le  contenu  de 
1 'enveloppe  % 


II  appartient  au  Commandant,  s'il  le  juge  utile,  de  faire  parvenir  un  exemplaire  du  dossier  a  chacun 
des  autres  membres  de  1 'equipage  pour  information  demande  de  renseignement  ou  d'avis.  II  pourra  faire 
parvenir  sa  reponse,  verbale  ou  ecrite,  sous  forme  anonyme  ou  non,  a  l'Officier  de  Securite  des  Vols, 
a  son  Chef  Pilote,  ou  aux  representants  mandates  des  Organisations  Professionnelles . 
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8.3.  La  Commission  d* Analyse  des  Vols 

Les  dossiers  de  Cas  d' Analyse  des  Vols  —  eventuel lement  completes  par  les  reponses  aux  communicat ions 
anonymes  —  sont  per iodiquement  (tous  les  2  mois)  examines  par  la  Commission  d* Analyse  des  Vols. 

a?  Composition  de  la  Commission  : 

Pres  idee  par  l*off icier  de  Securite  des  Vols,  la  Commission  regroupe  des  representants 

-  des  Divisions  de  vol, 

-  des  Services  Techniques, 

-  des  Divisions  d ' Instruct  ion, 

-  du  Service  Niveau  Professionnel , 

-  des  Organisat ions  Professionnelles  Pilotes  et 
Mecaniciens  Navigants. 


b)  Travaux  de  la  Commission  : 


Chaque  dossier  —  precedemment  transmis  aux  participants  —  fait  l'objet  d'un  expose  suivi  d*une 
discussion  ou  chacun  des  membres  de  la  Commission  d‘ Analyse  des  Vols  apporte  son  point  de  vue 
sur  les  causes  possibles  de  l’anomalie,  son  importance,  les  enseignements  a  en  tirer,  les  ac¬ 
tions  correctives  a  envisager. 

II  peut  etre  decide  de  demander  des  renseignements  complementaires  aux  equipages  ou  d'entre- 
prendre  des  etudes  part icul ieres  en  vue  d'analyses  ulterieures  plus  approfondies . 

En  fin  de  travaux,  la  Commission  d’Analyse  des  Vols,  pour  chacun  des  cas  etudies,  depose 
des  conclusions,  formule  des  recommand at  ions  et  propose  des  mesures  correctives. 


IX,  LES  RESULTATS  DE  L'ANALYSE  DES  VOLS  PRATIQUEE  A  AIR  FRANCE 


Telle  que  pratiquee  depuis  pres  de  10  ans  dans  le  cadre  du  Protocole,  I* Analyse  des  Vols  a 
permis,  outre  de  nombreux  resultats  dans  le  domaine  de  la  securite  des  vols,  de  creer  un  climat 
de  confiance  par mi  le  Personnel  Navigant  Technique  :  on  a  constate,  d'une  part,  une  augmenta¬ 
tion  du  nombre  de  rapports  equipages  signalant  des  anomalies  ou  incidents  de  vol  et,  d ‘autre 
part,  une  demande  de  plus  en  plus  frequente  des  Commandants  de  Bord  pour  prendre  connaissance 
du  depoui 1 lement  de  1 ‘enregistrement  de  l’un  de  leurs  vols  afin  d'apprecier  le  deroulement  de 
telle  ou  telle  manoeuvre  ou  procedure . 

Nous  citerons,  enfin,  certains  resultats  notables  de  1* Analyse  des  Vols  : 

9.1.  Principales  difficultes  ou  anomalies  mises  en  evidence  : 

risques  resultant  d’approches  sur  forte  pente  ou  en  forte  regression  de  vitesse, 
assorties  parfois  d ‘atterr issages  durs  avec  rebonds  ; 

-  difficultes  d'accrochage  a  haute  altitude  au  voisinage  du  plafond  (Boeing  747) 

risques  resultant  du  non  respect  des  minima  (difficultes  de  stabilisation  en 
conditions  mar g inales)  ; 

risques  resultant  de  1 1  inobservation  des  procedures  ou  des  regies  relatives  des 
taches  a  bord  (calage  des  altimetres,  lecture  de  la  radio-sonde,  surveillance  des 
parametres  de  vol  par  le  pilote  non  aux  commandes,  etc...). 

-  reduction  de  marqes  de  survol  des  obstacles 

-  vitesses  en  dessous  des  vitesses  requises  en  approche  intermediate,  pilote 
automat ique,  ou  svsteme  automanettes  enoaoe. 


9.2.  Principales  actions  correctives  menees  : 

-  creation  d ' apprnrhes-types  a  effectuer  en  vol  VMC  (Conditions  meteocologiques  de  vol 
a  vue)  sur  certaines  pistes  d'acces  difficile,  telles  que  la  piste  32  a  Marseille  et  la 
piste  21  a  Ajaccio  ; 

-  creation  ou  simplification  de  procedures  d'approches  aux  instruments,  par  exemple  a 
Pointe-a-Pitre  (piste  29)  et  a  Tanger  ; 

-  amelioration  de  la  documentat ion  concernant  notamment  la  presentation  des  informa¬ 
tions  sur  les  feuilles  de  procedure.  Par  exemple,  figuration  d ‘aerodromes  ayant  donne 
lieu  a  confusion  tels  que  les  terrains  civils  ou  militaires  voisins  de  ceux  de  Porto 
ou  d’Hanovre  ?  mentions  concernant  les  procedures  par t iculieres  de  reglage  des  alti- 
•notres  sur  les  aerodromes  des  Pays  de  l'Est  a  la  suite  d'erreurs  de  calage  altimetrique  ; 

-  mise  au  (mint  et  rappel  de  regies  a  appliquer  en  cas  d ' incapaci te ,  complete  ou  sub¬ 
tile,  du  pilote  aux  commandes  ; 

-  reexamen  des  conditions  d'execution,  sous  les  aspects  reglementaires,  organisation  et 
repartition  des  taches  a  bord,  des  percees  rad io-di r igees  et  des  approches  indirectes  ; 

-  diffusion  d'un  livr«t  sur  le  vol  en  haute  altitude. 


X.  BULLETIN  ^'ANALYSE  DES  VOLS  RESERVE  AU  PNT 


Los  ojs  analyse  des  vt>ls  los  plus  s  lqn  1  f  icat  i 1  s  lont  l'-ii-jet  d'uno  diffusion  pcriodi quo  roservee 
au  PNT  :  le  Bulletin  d* Analyse  des  Vols. 

Re* troupes  pat  families  lApprorhes  preci pi toes,  Erreurs  do  position  on  j[>[  roche,  \'<>n  respect  des 
procedures  et  minima,  ...)  ces  cas  sont  presented  on  reprenant,  pour  chjcun,  I'essentiel  des  ele¬ 
ments  du  dossier  (exi>ose,  trajectoirc,  profil,  paratm-tres  j  ,  le  deroulement  des  tr.ivaux  do  1j 
Comm iss ion ,  ses  conclusions,  recommand at  ions  et  propositions  do  mesuros  correctives. 


XI .  ST  AT l ST  1 OUES 


He  J97H  a  I9J2,  plus  de  J2h  non  veils  sur  SE  2K>,  L.727,  B.707,  ont  eto  analyses  : 

4772  f  iches  d' anomalies  (soit  1,4r>  *)  ont  eto  ctaLlies. 

Ces  anomalies  ont  6to  clnssees  par  types  d 'anotn.il  ies,  types  d'avion,  jour  ou  nuit,  etc. 

11  apparait  quo  e'est  on  enurs  d'approche  que  la  ( requeneo  des  anomalies  est  la  plus  elevee, 
notamment  du  fait  de  Vitesse  ou  de  pente  de  descente  elevee  en  appri>che  intermediate. 

Une  autre  classification  par  region  ou  ueroport  a  etc  eqalement  effectuee.  Celle-ci  montr** 
due  sur  certains  aer<>p*.»rts  tels  que  Ajaccio  ou  Marseille  la  frequence  des  anomalies  est 
Leaucoup  plus  elevee  quo  la  moyenne. 


XII.  CONCLUSIONS 


L'unalyse  des  vols  est  devenue  la  base  de  la  politique  de  prevention  des  .jccidents  i  Air  1'r.ino  . 

Pres  de  dix  ans  d’experience  ont  permis  de  def  ini  des  met  h«  Kies  et  de  developpor  des  moyens  cip.,- 
bles  de  couvrir  les  tiesoins  pour  l1 analyse  systemati que  de  tous  les  vols. 

La  participation  effective  ties  equipaqes,  qrare  au  respect  du  Protocole,  est  un  des  acquits  les 
plus  importants  de  1' Analyse  des  Vols. 

Celle-ci,  en  fournissunt  une  qrande  quantite  d ' informat  ions ,  a  perms  de  deuaaer  des  tend.mces 
et  d'en  identifier  les  causes.  Des  actions  correctives  ont  etc  menoes  dans  les  principaux  domaines 
d* act  ion  suivants  :  1  *  instruct  ion,  les  procedures  oper.it lonnel les ,  la  reqlemontat ion,  la  d-*cumen- 
tation,  1 1  information  et  la  sensibi 1 isation  des  equipaqes.  Elle  conduit  eqalement  a  der.  interven¬ 
tions  a u pres  des  aeroports  et  des  Centre*!  de  Controle  de  circulation  vricmv'. 


L'Analyse  des  Vols  est  done  un  maillon  essentiel  de  la  Uiucle  de  prevention  des  accident;;. 
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SUMMARY 

- T - 

'Up  to  now  the  in  service  usage  monitoring  of  the  military  aircrafts  has  been  conducted  main¬ 
ly  relying  on  g-counters  installed  or  each  aircraft,  but  the  extreme  complexity  of  the  present  com 
bat  aircrafts,  the  variety  of  their  tasks  and  usage  in  service,  suggest  now  the  opportunity  to  have 
a  cortinous  monitoring  of  the  structure  and  engine  usage  for  checking  the  integrity  and  the  life  con 
sumption . 

An  accurate  and  complete  monitoring  system,  which  is  considered  cost  effective,  presents, 
among  the  many  advantages,  those  of  allowing  a  greater  flight  safety.  The  system  in  development 
adopts,  as  basic  philosophy,  an  on  board  recording  facility  on  each  individual  aircraft  of  all  rele¬ 
vant  flight  and  aircraft  parameters  and  a  ground  equipment  performing  two  levels  of  analyis: 

(a)  trouble  shooting  for  structure,  engine  and  systems  limits  exceedances  or  malfunctions  after  each 
flight  during  the  normal  turn  around  time  giving  a  GO/NO  GO  indication  for  the  next  flight  and  Cb) 
a  detailed  calculation  of  fatigue  loading  experienced  during  each  flight  and  the  consequent  residual 
life  evaluation  for  the  critical  items,  thus  allowing  the  detailed  monitoring  of  the  usage  of  each  air 
craft. 


This  system  is  based  on  the  experience  gained  on  the  operations  of  the  Italian  combat  aircraft 
and  represents  a  now  approach  to  the  problem  to  guarantee  the  airframe  and  engine  safety. 

The  effectiveness  and  the  configuration  of  this  Maintenance  Recording  system  has  been  studied 
with  the  Italian  Airforce  which  is  going  to  implement  the  system  in  their  Tornado  operational  line. 


1.  NECESSITY  OF  A  MONITORING  SYSTEM 


The  extreme  complexity  of  a  modern  multi  role  aircraft  as  the  TORNADO,  the  great  variety 
of  tasks  it  has  to  performe  with  the  consequent  very  high  number  of  stores  and  store  combinations 
to  be  flown,  the  different  in  service  usage  of  the  aircraft, have  led  to  consider  highly  desirable  a 
continous  monitoring  of  the  aircraft  operations  to  check  the  structural  integrity  and  the  life  con¬ 
sumption  . 

The  main  advantages  of  such  a  monitoring,  if  performed  accurately  and  extensively,  can  be 
identified  as: 

-  greater  flight  safety 

-  optimization  of  aircrafts'  usage 

-  proper  planning  of  aircrafts'  inspections. 

In  fact,  the  consideration  of  the  theoretical  and  then  very  severe  fatigue  spectra  used  to  de¬ 
sign  the  structure  (including  the  engine  structures),  drastically  controls  the  in  service  life  of  the 
aircraft  and  requires,  for  each  component  of  the  fleet,  a  very  heavy  schedule  of  inspections  rela¬ 
ted  to  flown  hours  and  not  to  really  experienced  damage;  on  the  contrary,  the  knowledge  of  the 
service  usage  of  the  aircraft,  in  peace  time  surely  lighter,  can  lead  to  a  relaxation  of  the  inspec 
tions  schedule  with  the  same  safety  degree  and  high  effectiveness. 

To  meet  the  above  target,  two  main  requirements  have  been  put  for  the  study  of  a  monitoring 
system: 

-  fatigve  life  consumption  calculation 

-  facility  to  check  the  possible  exceedances  of  the  most  significant  flight  parameters  (during 

each  flight)  in  order  to  give  a  GO/NO  GO  indication  for  the  next  one. 


Airframe,  engine  and  some  among  the  most  important  aircraft  systems,  are  subject  tc  the  mo 
nitor  to  guarantee  a  complete  coverage  of  the  whole  aircraft. 


2 .  M AINTENANCE  RECORDER  SYSTEM 


To  fulfill  the  requirements,  different  solutions  have  been  considered  and  the  final  choice  has 
led  to  a  system  (see  fig.l)  whose  basic  philosophy  is  to  have  an  on  board  recording  facility  on 
each  individual  aircraft  of  all  relevant  parameters  and  an  on  ground  equipment  performing  two  le¬ 
vels  of  analysis: 

-  a  quick  look  check  to  detect  the  exceedances  of  design  limits  for  airframe  and  engine,  and 
the  possible  malfunction  in  the  aircraft  systems,  to  be  performed  during  the  turn  around  time 

-  a  detailed  calculation  of  the  fatigue  loading  experienced  during  the  last  flight  or  small  number 
of  flights  and  the  residual  life  evaluation  to  be  performed,  due  to  the  complexity  of  the  calcu 
lating  routines,  on  a  remote  computer  facility  located  in  the  airbase. 

In  detail,  and  in  particular  for  the  airframe,  the  reasons  for  the  choice  and  the  identified  mo 
nitoring  procedures  are  presented. 

2.1  AIRFRAME 

2.1.1  Method  selection 


To  find  the  mo.;..  suitable  solution  to  satisfy  the  requirements  from  the  airframe  side, 
the  possible  applicable  methods  have  been  compared: 

-  "g"  counters  installation 

-  strain  gauges  installation 

-  indirect  method. 

A  brief  analysis  of  each  possible  solution  shows  the  reasons  for  the  final  choice: 

a)  the  normal  practice  to  check  the  structural  life  of  the  combat  aircrafts,  has  been,  un 
til  now,  to  relv  on  g-counters  installed  on  each  airplane;  these  g-counters,  record  just 
the  number  of  times  when  established  levels  of  normal  acceleration  are  exceeded  and 
are  practically  of  no  use  for  an  aircraft  as  TORNADO  with  a  variable  wing  sweep,  lar 
ge  range  of  masses,  extended  flight  envelope,  big  variety  of  external  stores  and  aero¬ 
dynamic  configurations,  wide  range  of  different  missions,  because,  the  same  level  of 
normal  load  factor  causes  very  different  loads  on  the  same  component  being  at  the  same 
time  function  of  mass,  sweep,  mach  number,  altitude,  stores  configuration,  flap-slat  po 
sitior.  etc. 

As  an  indication,  two  self  explaining  examples  can  be  taken: 

-  considering  a  steady  manoeuvre  giving  5g  measured  at  the  aircraft  centre  of  gravity 
for  the  same:  mass,  wing  fuel  status  and  altitude,  the  bending  moment  at  a  wing  sta¬ 
tion  close  to  the  pivot  point  (wing  root)  shows,  depending  on  wing  position  and  Mach 
number,  differences  from  a  minimum  of  11%  up  to  a  maximum  of  33%,  these  data  being 
derived  from  in  flight  measurements. 

-  considering  a  steady  manoeuvre  giving  the  70%  of  the  design  vertical  bending  moment 
at  the  front  fuselage  transport  joint,  this  value  is  related  to  load  factors  which  dif¬ 
fer  for  more  than  30%  just  according  to  wing  sweeps  and  Mach  number  changes. 

The  differences  are  very  remarkable  and  due  to  the  fact  that  the  fatigue  endurance 
of  a  structure  is  extremely  sensitive  to  the  average  loads  level,  it  is  therefore  clear 
that  the  g-counter  indication  cannot  be  related  with  acceptable  accuracy  to  the  loads  a£ 
ting  on  the  main  structure. 

b)  the  ideal  case,  would  be  to  record  directly  the  stresses  experienced  in  all  the  major 
components,  through  a  direct  reading  of  strain  gauges;  on  this  bases,  in  fact,  a  direct 
calculation  of  damage  and  residual  life  is  possible  with  high  reliability.  But,  against 
this  solution  a  series  of  problems  difficult  to  resolve  in  an  operational  environment  rai_ 
ses: 


-  great  number  of  strain  gauges  requirement  with  consequent  installation  problems 


-  necessity  to  perform  strain  gauges  calibration  on  each  aircraft  and  a  series  of  check 
calibration  during  the  operational  life  of  the  aircraft 

-  necessity  to  perform  a  pre-flight  check  to  establish  the  datum  line  and  to  check  the 
correct  working  of  each  strain  gauge 

-  necessitv  of  high  accuracy  in  the  strain  gauges  positioning:  in  fact  their  extreme  sen_ 
sitivitv  can  cause,  on  different  aircrafts,  subtantiallv  different  answers  under  ti  e  so. 
me  load  and  in  the  same  nominal  position 

-  the  relative  low  life  of  the  strain  gauges,  compared  to  the  operational  life  of  the  ai£ 
craft,  implies  a  heavy  maintenance  activity 

-  a  very  high  sampling  rate  is  required  for  the  strain  gauges  readings  than  affecting 
the  recording  capabilities  in  term  of  number  of  parameters. 

The  strain  gauges  use,  is  a  typical  experimental  technique  for  prototype  and  develop¬ 
ment  flying  but,  for  the  above  reasons  they  cannot  be  practically  used  in  an  operational 

fleet. 

c)  the  indirect  method  is  based  on  the  recording  on  each  aircraft  of  the  fleet  of  a  certain 
number  of  significant  flight  parameters  and  on  the  subsequent  elaboration  of  the  data  ir 
order  to  obtain  the  loads  in  the  most  significant  parts  of  airframe  main  components  then 
allowing  for  the  proper  fatigue  considerations. 

Such  a  method  can  fully  satisfy  the  requirements  because: 

-  allows  the  quick  look  check  based  on  the  recorded  parameters 

-  allows  for  the  fatigue  calculation  with  the  necessary  accuracy  and  reliability 

-  avoids  the  use  of  a  model  investigating  statistically  the  occurrence  and  the  distribution 

of  damage  for  the  fleet  during  the  operative  life,  being  this  method  not  sufficiently 

accurate  and  sometime  very  misleading  in  the  results. 

2.1.2  Parameters  recording 


The  parameters  proved  to  be  necessary  for  the  required  analysis  on  the  airframe  and 
therefore  recorded  in  flight,  are  subdivided  into  four  groups: 

-  Aircraft  configuration  parameters:  all  those  allowing  to  identify  the  mass  ant1  the  cen¬ 
tre  of  gravity  position  as  fuel  weight,  stores  type  and  location,  wing  sweep  angle  or 
the  aerodynamic  configuration  as  wing  sweep  angle,  high  lift  devices  position,  etc. 

-  Air  data  and  aircraft  attitude  parameters:  Mach  number,  altitude,  speed,  incidence, 
sideslip,  etc. 

-  Control  surfaces  deflections:  spoilers,  tailerons,  rudder,  airbrakes,  etc. 

-  Aircraft  response  parameters  as  linear  and  angular  accelerations  and  angular  velocities. 

A  sampling  rate  of  83/ sec,  as  a  minimum,  is  required  for  all  the  aircraft  response  p£ 
rameters,  air  data  and  aircraft  attitude,  primary  control  surfaces  deflection;  this  because 
such  a  sampling  is  suitable  for  the  representation  of  the  rigid  body  motion  of  the  aircraft; 
for  other  parameters  IS/sec  or  0.5S/sec  is  enough. 

The  data  compression  procedure  is  adopted  to  increase  sensibly  the  recording  time  ca¬ 
pability.  Fig. 2  shows  in  detail  the  parameters  required  for  the  structure  monitoring. 

2.1.3  First  analysis 

The  purpose  of  the  first  analysis  is  to  supply  clear  and  complete  informations  about  the 
aircraft  use  during  last  flight,  to  enable  a  quick  evaluation  of  the  experienced  loading  levels 
and  their  comparison  with  the  allovable  structural  limitations,  to  detect  the  possible  cxceedan 
ces  of  the  above  limitations  and  to  finalize  the  decision  to  go  for  next  flight  with  the  required 
safety. 


The  analysis  is  performed  during  the  turn  around  time  (average  duration  of  15  minutes), 
near  the  aircraft,  with  a  proper  equipment  identified  as  Mobile  Quick  book  Facility  (it  is  hand 
carried  and  reasonably  light  weight),  able  to  read  the  cassette  from  the  recording  unit  and  to 


process  the  data  according  to  the  criteria  established  for  check.  It  is  intended  to  base  the 
GO/NO  GO  decision  on  the  check  of:  vertical  load  factor,  roll  rate,  Mach  number,  calibra¬ 
ted  airspeed,  sinking  speed. 

A  limited  number  of  parameters  (fig. 3)  is  selected  from  the  complete  structural  list  to 
identify  the  characteristics  ruling  the  limitations,  these  being  function  of  the  wing  sweep,  the 
high  lift  devices  position,  the  mass  of  the  aircraft,  the  fuel  status  in  the  wing,  the  external 
stores  configuration  and,  of  course  the  Mach  number  and  the  speed.  A  credibility  check  is 
performed  on  the  selected  parameters  to  detect  the  possible  spikes  and/or  uncorrect  values; 
each  parameter  is  compared  with  its  possible  range  and  max  rate  of  change  to  ascertain  its 
validity.  Afterward,  the  procedure  for  the  analysis  is  slightly  different  depending  on  the  air¬ 
craft  configuration:  clean  or  with  external  stores. 

2.1.3. 1  Clean  aircraft 

al)  Vertical  load  factor 

The  vertical  load  factor  is  recorded  in  flight  and  is  compared  with  the  allowable  only 
when  it  is  higher  than  a  minimum  imposed  value,  for  speeding  up  the  check. 

To  identify  the  allowable  load  factor  it  is  necessary  to  know: 

-  wing  sweep  angle  :  directly  recorded  (four  positions  are  considered: 

fully  open,  two  intermediate,  fully  swept) 

-  flap  and  slat  position  :  directly  recorded  (four  positions  are  considered: 

cruise,  manoeuvre,  intermediate,  high  lift) 

-  aircraft  mass  :  derived  by  calculation  from  recorded  data  (fuel  con¬ 

tent  directly  recorded  and  the  mass  of  the  empty  aij~ 
craft,  input  data,  are  used) 

-  fuel  status  in  the  wing  :  derived  by  calculation  from  recorded  data  (fuel  con¬ 

tent  directly  recorded  and  the  fuel  transfer  sequen¬ 
ce,  input  deta,  are  used) 

-  roll  rate  :  directly  recorded. 

Each  combination  of  wing  sweep  angle,  flap  and  slat  position  and  fuel  status  in  the 
wing,  identifies  the  allowable  symmetric  load  factor  as  function  of  the  aircraft  mass; 
the  structural  capabilities  of  main  components  are  imposing  this  allowable  which  will 
then  protect  the  whole  aircraft.  Important  role  is  played  by  the  roll  rate:  in  fact  a 
reduction  of  the  allowable  symmetric  load  factor  is  applied  according  to  the  value  as 
sumed  by  this  parameter  during  the  in  flight  manoeuveringj  90"£  or  80%  of  the  maxi¬ 
mum  are  related  to  intermediate  or  high  values  of  roll  rate.  To  cover  the  gap  bet¬ 
ween  the  different  load  factor  functions  when  the  wing  sweep  angle  or  the  flap  and 
slat  position  are  changing  and  when  fuel  is  being  transferred  from  wing  to  the  fuse¬ 
lage,  the  assumption  to  compare  the  measured  load  factors  with  the  most  critical  ca 
se  between  the  startirg  or  the  final  position  has  been  made  to  consider  the  change 
of  loading  conditions  due  to  the  varying  aerodynamic  and/or  inertia  characteristics. 

bl)  Roll  rate 

The  maximum  value  of  the  roll  rate  is  a  design  case  for  the  wet  wing  outboard  struc 
ture,  then  the  check  is  required  for  each  asymmetric/rolling  manoeuvre  performed 
with  fuel  in  the  wing.  The  roll  rate  is  recorded  in  flight  and  is  compared  with  the 
allowable  which,  being  function  of  the  wing  sweep  only,  can  be  identified  with: 

-  wing  sweep  angle:  directly  recorded 

the  fully  open  and  the  first  intermediate  positions  only  can  be  critical  and  are  then 
checked. 

cl)  Mach  number 

The  Mach  number  is  recorded  in  flight  and  is  compared  with  the  allowable,  function 
of  wing  sweep  and  flap/ slat  position;  the  parameters  required  arc  both  directly  re¬ 
corded: 


-  wing  sweep  angle 

-  flap  and  slat  position 


1-ach  relevant  flight  envelop0  Mach/altitude  can  In’  easily  checked 


ill)  Calibrated  airspeed  CAS 

The  in  port  a  nee  of  the  Calibrated  airspeed  for  the  design  of  the  structures  requires 
a  cheek  for  this  parameter;  it  is  dependent  on  the  wing  sweep  and  flap/ slat  position, 
then  the  comparing  procedure  is  sinilur  to  that  at  point  cl). 


el)  Sinking  speed 

The  sinking  spied  is  the  most  significant  parameter  to  have  tie  indication  of  the  loa 
ding  level  or.  the  undercarriage ;  for  this  reason  it  is  derived  bv  calculation  using: 

-  vertical  velocity  :  directly  recorded 

-  ground  velocity  :  derived  bv  calculation  from  North  and  Hast  velocities 

and  heading  angle  (directly  recorded) 


-  de  rot  at  ion  rate 

-  runway  slope 

-  aircraft  mass 

-  undercarriage  on  ground 


directly  recorded 
input  data 

derived  by  calculation  (sec  point  al)) 
directly  recorded 


-  thrust  reverser  on 


directly  recorded. 


To  have  the  final  allowable,  corrections  are  made  proportional  to  the  bank  angle  tc 
consider  the  asymmetric  landings.  Very  important,  for  the  nose  undercarriage  are 
the  derotation  speed  and  the  thrust  reverser  effects.  Fig. 4  shows  the  chock  proce¬ 
dure  for  the  clean  aircraft. 


2.  1.3.2  Aircraft  with  stores 


The  presence  of  the  external  underwing  oi  underfuselage  stores  implies  some  additional 
limitations  to  those  of  the  clean  aircraft;  they  are  peculiar  of  the  store  type  and  status  (e.g. 
fuel  tanks)  and  sometime  of  the  store  position .  A  very  hig  effort  has  boon  spent  to  be  able  to 
record  the  initial  stores  configuration  and  to  have,  during  the  flight,  the  continous  updating 
of  such  configuration . 

a2)  Vertical  load  factor 

The  same  procedure  as  for  clean  aircraft  except  that: 

-  the  aircraft  weight  is  derived  considering  the  pylons  and  stores  weights  in  addi¬ 
tion  to  tho  empty  mass  and  the  fuel  content 

-  the  allowable  load  factor  is  dependent  on  the  single  stores  and  their  combination 
and  is  subject  to  changes  during  night  together  wit!  the  configuration  evolution. 

The  limitations  are  superimposed  to  ihe  clean  nirc.aft  ones  and  the  minimum  bet¬ 
ween  the  two  is  the  final  allowable 

-  ti  c  fuel  content  is  now  the  sum  of  internal  and  external  tanks;  the  fuel  transfer 
sequence  gives  the  informations  about  the  locution 

-  when  a  store  is  released /jettisoned  the  flight  load  factor  at  the  release/ jettison  ti_ 
me  is  checked  with  the  relevant  allowable. 

b2)  Roll  rate 

Same  procedure  as  for  clean  aircraft. 

c2)  V.ach  number 

Same  procedure  as  for  clean  aircraft  but  using  the  Mach  limits  relevant  to  the  stores 

configuration.  Additional  check  for  Mach  limits  in  release  (jettison  cases,  is  provi¬ 
ded. 

(12)  (.'alii  rated  air*  peed  ('AS 

Same  p roe od ure  as  for  clean  aircraft  but  using  the  CAS  limits  relevant  to  the  stores 

eor.figni  alieii .  Additional  cheek  for  CAS  limits  in  release ! jettison  eases,  is  provided. 
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e2)  Sinking  speed 

Same  procedure  as  for  clean  aircraft  with  different  procedure  to  define  the  aircraft 
mass  (see  point  a 2)). 

Fig.  5  shows  the  check  procedure  for  the  aircraft  with  stores.  When  the  analysis  of  the 
flight  is  completed  the  results  shown  by  the  MQLF  can  be: 

-  GO  indication 

-  NO  GO  indication 

-  WARNING  indication 

the  GO  indication  is  presented  when  no  limit  has  been  exceeded  during  the  complete  flight, 
and  the  permission  for  the  next  one  is  automatically  released. 

The  NO  GO  indication  is  presented  when  one  or  more  limits  have  been  exceeded  during 
the  flight,  at  the  same  time  or  at  different  times;  in  this  case  the  permission  for  the  next 
flight  is  subject  to  the  analysis  of  the  exceedence  (all  the  relevant  parameters  necessary  for. 
the  analysis  are  shown  bv  the  MQLF  for  the  time  of  the  exceedance)  and,  if  necessary,  dif¬ 
ferent  levels  of  check  on  the  structure.  The  Warning  indication  is  presented  when: 

-  there  is  difference  between  operational  and  design  limits  and  the  measured  parameter 
belongs  to  this  gap 

-  the  measured  parameter  belongs  to  a  tolerance  band  on  the  design  values  applied  to 
cover  the  unaccuracy  in  the  measurements  of  the  parameter  itself  and  of  the  parameters 
used  to  establish  the  allowable. 

In  the  case  of  the  warning  the  release  to  next  flight  is  subject  to  the  judgement  of  the 
technical  authority  of  the  airbase. 

2.  1.4  Pet  ailed  analysis 

The  purpose  of  the  detailed  analysis  is  to  evaluate  the  damage  experienced  by  the  air¬ 
frame  during  each  flight  and  to  establish  the  remaining  life.  The  requirement  is  that  the  time 
of  the  analysis  must  be  one  half  of  the  flying  time;  the  analysis  is  performed  by  a  computer 
facility  named  Automatic  Ground  Station  whose  main  task  is  the  fatigue  consumption  calculation; 
additional  utilities  allow  the  AGS  a  series  of  data  elaboration  and  presentation  for  additional 
investigations  and/or  purposes. 

The  complete  set  of  parameters  recorded  in  flight,  is  used  for  the  detailed  analysis; 
after  the  credibility  check,  the  flight  is  fully  analyzed  selecting  the  time  slices  that  can  be 
significant  for  t)  e  fatigue  calculation  (mainly  those  with  high  rate  of  change  of  some  reference 
parameters).  The  loads  are  calculated  in  these  time  slices  and  then  selected  again  to  give  the 
significant  points  of  each  manoeuvre  thus  allowing  the  change  of  the  loads  time  histories  into 
loads  duty  cycles  to  be  added  to  the  already'  cumulated  ones. 

The  obtained  spectra  are  directly  compared  with  those  tested  in  the  fatigue  test  preseit 
tly  performed  on  the  complete  aircraft  or  furtherly  transformed  into  stress  cycles,  where  the 
test  results  are  not  available,  and  then  compared  with  the  design  spectra.  The  damage  calcu¬ 
lation  for  each  fatigue  critical  component  and  the  residual  life  determination,  is  the  final  re¬ 
sult  of  the  analysis. 

The  monitored  components  (presently  around  10  critical  items  are  considered),  are  loc£ 
ted  on:  wing,  tailerons,  fin  and  fuselage,  thus  covering  the  whole  airframe.  If  the  results  of 
the  above  mentioned  fatigue  tests  will  show  some  unexpected  critical  item,  it  will  be  easily  in 
eluded  in  the  monitored  group  replacing  a  less  critical  one. 

The  loads  are  derived  from  the  flight  loads  measurements  obtained  from  the  Flight  Loads 
Survey  program  extensively  performed  on  fully  instrumented  TORNADO  prototypes  and  covering 
all  the  main  structural  components:  data  are  available  for  wing,  fin,  tailcron,  front  and  rear 
fuselage,  external  underwing  and  underfuselage  stores,  thus  allowing  the  definition  of  the  load 
levels  with  the  necessary  accuracy.  Due  to  the  very  high  influence  of  the  load  levels  accurai 
cy  in  the  fatigue  life  determination,  particular  attention  has  been  paid  for  this  flight  measured 
data  bank. 


If  the  case  of  loss  of  recorded  data  will  occur,  the  flight  will  be  covered  by  data  theo 
rctically  derived  with  design  spectra.  With  this  analysis,  the  confirmation  of  the  structural 
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integrity  is  obtained  and  the  fatigue  endurance  cf  the  airframe  is  defined,  thus  satisfying  the 
requirement  of  a  long  term  safety  and,  at  the  same  time,  giving  important  informations  about 
the  usage  of  each  aircraft  to  optimize  its  operational  life.  Fig. 6  shows  the  check  procedure 
for  the  airframe. 

2.2  ENGINE 

The  engine  monitoring  system  is  mainly  aimed  to  evaluate  the  low  cycle  fatigue  (L.C.F.) 
life  consumption  of  the  group  A  parts,  that  is,  components  which  have  a  finite  life  and  whose 
failure  could  result  in  a  catastrofic  damage  to  the  aircraft.  The  basic  parameters  needed  for 
E.C.F.  usage  monitoring  are  grouped  as  follows: 

-  Aircraft  parameters  :  pressure  altitude,  calibrated  airspeed,  total  air 

temperature  directly  recorded 

-  Engine  (left  and  right)  parameters  :  HP,  EP,  IP  rotor  speed,  Turbine  Blade  tempe¬ 

rature  directly  recorded 

-  Additional  parameters  :  HP,  LP,  IP  Torques  and  Stator  Outlet  Tempera¬ 

ture  derived  from  the  basic  ones  using  performan 
cc  curves. 

l  or  the  E.C.F.  purposes,  a  sampling  rate  of  two  per  second  is  considered  adeguatc. 
After  the  credibility  check,  the  flight  recorded  data,  will  be  processed  bv  a  computer  pro¬ 
gramme  on  the  AGS  which  will  performe,  for  all  critical  areas  of  group  A  parts,  the  follo¬ 
wing  tasks: 

a)  calculation  of  stresses  (centrifugal,  thermal,  torsional  etc)  ant',  temperature  combina¬ 
tion  occured  during  the  whole  mission. 

b)  reduction  of  the  flight  profile  by  successively  removing  each  complete  minor  cycle  and 
translation  of  sub-cycles  into  equivalent  zero-max  cycles. 

c)  relative  damage  factor  evaluation  by  using  the  material  S-N  curves. 

In  addition,  the  continous  recording  of  engine  parameters,  will  allow  to  performe  on  the 
MQEF  a  check  to  provide  GO/NO  GO  informations.  The  quick  look  analysis  will  allow  for: 

a)  check  of  engine  starting 

b)  check  of  setting  limit  exceedences 

c)  time-temperature  exceedences 

d)  vibrations,  oil  pressures  warning. 

The  list  of  parameters  required  for  E.C.F.  and  the  quick  look  check  is  shown  in  fig. 7. 

2.3  AIRCRAFT  SYSTEMS 

Selected  parameters  of  aircraft  systems  arc  recorded  in  flight,  and,  integrated  with  tho¬ 
se  displayed  on  the  Central  Maintenance  Panel  (CMP)  are  interpreted  on  ground  by  the  MQEF 
for  a  rapid  GO/NO  GO  indication.  The  recorded  data  will  be  subsequently  analyzed  by  the 
AGS  with  the  aim  to  generate  an  up  dated  situation  of  ERl's  and  systems  failures  for  each 
aircraft  to  be  used  to  plan  repairs  or  rcplacomentes  and,  when  possible,  to  feed  back  to  air 
craft  corr.porent  manufacturers  precise  informations  on  product  quality.  The  recorded  parame¬ 
ters  are  shown  in  fig. 8.  In  addition  80  parameters  (ON-OFF  EIGHTS)  are  taken  from  CMP. 

3.  CONCLUSION  S 


The  proposed  System  will  record  during  the  flight  some  75  parameters  relevant  to  airfra 
me,  engine  and  systems  monitoring.  Considering  the  sampling  rate  required  for  each  parameter 
and  varvtng  from  0.5  to  SS/soc,  a  total  number  close  to  the  Data  Acquisition  Unit  capabilitv 
of  256  words/sec  will  be  recorded;  In  addition,  80  parameters  giving  information  from  the 
CMP  will  be  added.  The  realization  of  the  system  is  at  its  final  stage,  being  now  fitted  on  a 
series  aircraft  to  undertake  the  installation  and  EMC  testing;  the  flight  testing  will  fellow  in 
84  and  after  the  final  clearances  tssue,  it  will  start  the  in  service  activity  beginning  85  or 
the  Italian  TORNADO,  representing  a  surely  original  and  reliable  contribution  to  the  control 
of  aircraft  operational  life  for  the  flight  safety  aspects. 
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MAINTENANCE  RECORDER  SYSTEM 


El«.  I 


PARAMETERS 
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STRUCTURE  MONITORING 


Aircraft  configuration 


Air  data  and  aircraft 
attitude 


Control  surfaces 
deflections 


Aircraft  response 


Fuel  content 
Wing  sweep  angle 
Flap  and  slat  angle 
External  stores:  initial  configuration 
(type  &  position) 
updating  configuration 
(jetti  son  /  r  el  ea  se) 

U/C  touch  down 
Mach  number 

Calibrated  air  speed  CAS 

Altitude 

Incidence 

Sideslip  (derived  by  calculation) 

Inclination  angle 
Heading  angle 
Bank  angle 

North,  East  and  Vertical  velocities 

Spoilers  angle 
Taileron  angle 
Rudder  angle 
Airbrakes  position 
Thrust  reverser 

Angular  rates  p,  q,  r 
Linear  accelerations  n  ,  n 

y'  z 

Angular  accelerations  p,  q,  r 


FIG.  2 
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Flap  and  slat  angle 
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U/C  touch  down 
Mach  number 

Calibrated  airspeed  CAS 
Altitude 
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Linear  accelerations  n 


FIG.  3 
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'  ROTORCRAFT  ICING  TECHNOLOGY  -  AN  UPDATE 

by 

LTC  R.  WARD,  US  ARMY 
Director,  Flight  Test  Directorate 
US  Army  Aviation  Engineering  Flight  Activity 
Edwards  AFB,  California  93523  USA 

and 

H.  W.  CHAMBERS 

Aerospace  Engineer,  Directorate  for  Development  and  Qualification 
US  Army  Aviation  Research  and  Development  Command 
St.  Louis,  Missouri  63120  USA 


SUMMARY 

"Flight  testing  of  rotorcraft  in  natural  icing  conditions  is  essential  to  the  US  Army 
Airworthiness  Qualification  requirements  and  to  the  US  Federal  Aviation  Administration 
certification  requirements  as  well  as  to  support  research  and  development  efforts. 
Complete  qualification/certification  under  natural  icing  conditions  only  is  very 
expensive  in  terms  of  time  due  to  the  limited  availability  of  the  required  test 
conditions  in  the  natural  environment.  Consequently,  inflight  icing  facilities  that 
can  duplicate  the  natural  environment  as  well  as  extreme  test  conditions  rarely  found 
in  natural  conditions  but  necessary  to  meet  Airworthiness  Qualification/Certification 
requirements  are  essential  to  augment  natural  icing  tests.  It  is  essential  that 
such  facilities  accurately  duplicate  the  natural  environment  so  that  test  results  can 
be  used  for  Airworthiness  Qualification/  Certification  with  a  high  degree  of  confidence. 


1 .  INTRODUCTION 

The  US  Army  has  conducted  artificial  and  natural  icing  tests  on  rotorcraft  since 
1973.  Flight  tests  have  included  research  and  development  efforts  as  well  as  airworth¬ 
iness  qualification  testing  of  US  Army  aircraft  for  flight  into  icing  conditions. 
Artificial  icing  tests  have  been  conducted  using  the  Canadian  National  Research  Council 
(NRC)  icing  spray  rig  in  Ottawa,  Canada,  and  the  US  Army  JCH-47C  with  an  installed 
Helicopter  Icing  Spray  System  (HISS).  The  HISS  has  proven  to  be  a  very  valuable  test 
facility,  not  just  for  the  US  Army  but  for  other  agencies  such  as  the  National  Aero¬ 
nautics  and  Space  Administration  (NASA),  the  Federal  Aviation  Administration  (FAA) . 
US  Air  Force  (USAF),  and  United  States  aircraft  manufacturers.  A  continuous  development 
effort  has  resulted  in  significant  improvements  in  the  HISS,  and  the  US  Army  icing 
flight  test  capability  has  expanded  to  improve  qualification  efforts.  The  improvements 
have  ultimately  led  to  an  artificial  spray  cloud  which  has  characteristics  approaching 
those  in  the  natural  icing  environment.  Future  efforts  will  ultimately  result  in  a  new 
system  which  will  significantly  improve  inflight  artificial  icing  test  capability. 

Many  of  the  US  Army's  efforts  in  rotorcraft  icing  technology  coincide  with  Advisory 
Group  for  Aerospace  Research  and  Development  (AGARD)  efforts  to  influence  technology. 
Specifically,  many  of  the  AGARD  recommended  efforts  contained  in  AGARD  Advisory  Report 
No.  166,  Rotorcraft  Icing,  Status  and  Prospects,  August  1981,  have  been  addressed  by 
the  US  Army  and  are  reported  on  in  this  paper  as  an  update  of  rotorcraft  icing  tech¬ 
nology.  While  not  all  inclusive,  the  following  selected  programs  provide  an  update  of 
some  flight  testing  conducted  to  date  relative  to  the  "icing  test  facilities"  and  "ice 
protection  systems”  discussions  contained  in  AR  166: 

a)  Flight  testing  of  pneumatic  deice  boots  installed  on  a  UH-1H  helicopter  in 
artificial  icing  conditions  behind  the  Canadian  NRC  Ottawa  Spray  Rig. 

b)  Artificial  and  natural  icing  tests  of  the  unprotected  CH-47C  and  UH-60A  heli¬ 
copter  rotor  systems. 

c)  Evaluation  of  ice  shapes  on  a  UH-1H  rotor  system  and  hover  performance  degra¬ 
dation  caused  by  rotor  icing. 

d)  Current  and  Planned  improvements  to  the  US  Army  JCH-47C  Helicopter  Icing  Spray 
System  (HISS) . 

The  US  Army  currently  qualifies  aircraft  for  flight  through  the  moderate  icing 
intensity,  which  is  defined  as  1  gm/m3  liquid  water  content  (LWC).  Based  on  present 
design  criteria  of  protecting  rotorcraft  to  1  gm/m3  there  is  less  than  a  one  percent 
probability  that  more  severe  icing  conditions  will  occur  on  a  typical  operational 
mission  in  continuous  maximum  (strat  form  clouds)  icing.  The  criteria  is  fully  defined 
in  reference  I,  and  shown  in  figure  1.  While  the  US  Army  qualifies  to  1  gm/m3  at  the 
current  time,  future  plans  are  to  increase  the  HISS  capability  to  produce  at  least 
2  gm/m^  and,  if  possible,  3  gm/m3,  This  will  allow  a  more  thorough  evaluation  of 
intermittent  maximum  icing  conditions  on  the  rotorcraft 's  capabilities  as  well  as 
provide  an  improved  research  and  development  capability. 
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2.  FLIGHT  TESTING  OF  PNEUMATIC  DEICE  BOOTS 

The  NASA  initiated  a  program  in  1980  to  evaluate  the  feasibility  of  pneumatic  boot 
deicing  concepts  for  helicopter  rotor  systems.  The  B.F.  Goodrich  Company  (BFG)  proposed 
a  concept  which  used  a  polyurethane  elastomeric  material  (trade  name,  Estane)  for  the 
boot.  Limited  wind  tunnel  icing  tests  conducted  by  NASA's  Lewis  Research  Center  indi¬ 
cated  that  it  might  be  feasible  to  produce  a  pneumatically  deiced  rotor  blade.  NASA's 
Ames  Research  Center  requested  the  assistance  of  the  US  Army  Aviation  Research  and 
Development  Command  (AVRADCOM)  in  flight  testing  the  concept.  Subsequently,  AVRADCOM 
tasked  the  US  Array  Engineering  Flight  Activity  (USAAEFA)  to  conduct  feasibility  testing 
of  the  Pneumatic  Boot  Deicing  System  (PBDS)  concept.  Potential  advantages  of  pneumati¬ 
cally  deiced  rotor  systems  include  a  low  power  requirement,  reduced  system  complexity, 
reduced  weight,  and  rapid  deicing  of  the  rotor  blade. 

BFG  manufactured  a  set  of  pneumatic  boots  and  installed  them  on  a  set  of  U.S 
Army-owned  UH-1H  main  rotor  blades.  Bell  Helicopter  Textron  (BHT) ,  under  a  NASA 
contract,  instrumented  one  blade,  main  rotor  hub,  mast,  pitch  change  link,  and  the 
three  main  rotor  control  actuator  extension  tubes  for  inflight  measurement  of  structural 
loads.  BHT  also  designed  and  built  an  instrumentation  and  pneumatic  slip  ring  assembly 
to  be  installed  at  USAAEFA  prior  to  testing. 

The  objective  of  this  program  was  to  determine  an  operational  envelope  and  conduct 
feasibility  testing  of  the  PBDS  concept  in  both  dry  air  and  artificial  icing  conditions. 
(Ref  2) 

The  test  aircraft  was  a  JUH-1H  helicopter  U.S.  Army  S/N  70-16318.  It  was  modified 
to  incorporate  a  partial  ice  protection  system,  which  included  pneumatically  deiced 
main  rotors,  heated  glass  windshields  and  a  Rosemount  ice  detector.  The  aircraft  was 
also  instrumented  to  record  structural  load,  performance,  and  handling  qualities 
parameters.  A  schematic  of  the  pneumatic  deice  system  and  cross  section  of  the  deice 
boot  is  presented  in  figures  2  and  3,  respectively.  Basically,  bleed  air  from  the 
customer  bleed  air  source  on  the  engine  is  routed  through  a  regulator  valve  then  up 
the  main  rotor  mast  to  a  pneumatic  slip  ring  and  then  to  the  leading  edge  pneumatic 
boots.  The  boots  are  deflated  by  forcing  engine  bleed  air  through  an  ejector  pump  to 
apply  continuous  suction  to  the  rotor  blades  except  during  the  inflation  cycle. 

Flight  testing  to  develop  a  flight  envelope  included  ground  runs,  hover,  climbs, 
level  flight,  turns,  descents,  and  autorota t iona 1  flight.  The  boots  were  inflated, 
deflated,  and  partially  inflated  as  would  be  typical  of  the  case  if  the  air  source  for 
the  ejector  pump  was  turned  off,  or  the  engine  failed.  All  structural  loads  were  well 
within  the  prescribed  limits  for  the  limited  envelope  developed  except  for  the  main 
rotor  pitch  link  axial  load  which  exceeded  endurance  limits  during  turns  of  30  degrees 
of  bank  with  the  boots  inflated.  The  flight  envelope  for  the  pneumatic  system  was 
opened  up  to  100  knots  (185  km/hr)  calibrated  airspeed  (KCAS)  and  a  gross  weight  of 
8600  pounds  (3900  kg). 

Investigation  of  handling  qualities  has  shown  that  there  has  been  no  significant 
difference  between  the  standard  UH-1H  and  the  test  JUH-1H  with  the  pneumatic  boot 
deflated.  Inflation  of  the  pneumatic  boot,  however,  resulted  in  a  mild  right  yaw, 
followed  by  a  right  roll  and  pitch  down.  All  rates  were  easily  compensated  for  by  the 
pilot. 

Performance  testing  revealed  substantial  performance  penalties  associated  with 
the  pneumatic  boot  both  in  the  inflated  and  deflated  mode.  Nondi mens iona 1  hover  per¬ 
formance  at  a  five-foot  (1.5  m)  skid  height  is  presented  in  figure  4.  The  data  compares 
a  standard  UH-1  to  the  test  aircraft  with  the  pneumatic  system  inflated,  deflated 
(normal),  and  with  the  system  vented  (partial  inflation)  such  as  would  occur,  if  the 
ejector  pump  air  source  was  interrupted. 

Level  flight  performance  is  shown  in  figure  5.  At  90  knots  (167  km/hr)  true 
airspeed  (KTAS) ,  the  pneumatic  boot  system  requires  approximately  150  additional  shaft 
horsepower  if  the  system  is  deflated  and  a  250  shp  increase  if  the  system  is  vented. 

Icing  tests  were  conducted  in  Ottawa,  Canada  at  the  NRC  spray  rig  shown  in  figure  6. 
The  test  conditions  were  0.25  gm/m3  at  temperatures  of  -6  to  -20°C;  0.4  gra/m^  at  -9  and 
-11°C  0.5  gm/m3  at  -6,  -11,  and  -15°C;  and  0.75  gm/m3  at  -6,  -10  and  -li'C.  Initial 
evaluation  of  the  pneumatic  deice  boots  is  encouraging.  Except  for  small  amounts  of 
residual  ice,  activation  of  the  system  cleaned  the  main  rotor  blades  of  accreted  ice 
as  shown  in  the  photos  in  figures  7  and  8.  The  pneumatic  system  shed  Ice  successfully 
with  the  rotors  turning  at  a  hover  and  also  without  the  aid  of  centrifugal  force  and 
vibration  when  the  blades  were  stationary.  The  aircraft  should  be  ready  for  forward 
flight  icing  tests  during  the  1983/1984  icing  season. 

3.  UNPROTECTED  ROTOR  SYSTEMS 

The  USAAEFA  has  conducted  two  flight  test  programs  to  evaluate  the  abilities  of  unpro¬ 
tected  rotor  systems  to  operate  In  icing  conditions.  The  CH-47  and  UH-60  helicopters 
were  the  test  articles.  In  both  programs,  the  aircraft  were  equipped  with  electro 
thermal  deice  systems  on  the  rotors,  but  the  systems  were  not  activated  unless  an 
inflight  situation  arose  which  required  deice  of  the  rotor  system.  Both  artificial 
(to  gain  confidence  in  procedures  and  equipment)  and  natural  icing  tests  were  conducted. 
Test  conditions  for  the  UH-60  test  are  presented  in  figure  9.  The  test  conditions 


were  documented  by  a  U-21  fixed  wing  aircraft  which  recorded  liquid  water  content, 
outside  air  temperature,  median  volumetric  diameter  and  relative  humidity.  The  U-21 
cloud  measuring  equipment  is  described  in  detail  later. 

Main  rotor  ice  sheds  occurred  on  the  UH-60  in  both  artificial  and  natural  icing 
environments.  The  first  ice  shed  during  a  flight  typically  occurred  from  15  minutes 
to  an  hour  after  entering  the  icing  environment.  Random  and  frequent  sheds  occurred 
thereafter.  The  main  rotor  ice  sheds  resulted  in  light  to  moderate  Increases  in  air¬ 
frame  vibration  which  normally  lasted  less  than  a  minute.  This  increased  vibration 
level  was  barely  apparent  to  an  experienced  aircrew  fully  occupied  by  their  tasks 
and,  on  occasion,  noticeable  only  if  their  attention  was  directed  to  it.  One  main 
rotor  ice  shed  occurred  during  artificial  icing  at  0.5  go/m3  LWC  and  -12.5“C,  which 
resulted  in  an  airframe  vibration  immediately  apparent  to  the  aircrew  but  did  not 
significantly  affect  their  work  load  over  the  length  of  time  the  vibration  lasted 
(approximately  10  minutes).  The  increase  in  airframe  vibrations  due  to  main  rotor  ice 
shedding  was  not  a  problem. 

Engine  torque  increased  with  ice  accretion  and  decreased  when  ice  was  shed  from 
the  rotor  system.  Accurate  measurement  of  torque  increase/decrease  was  not  possible 
while  flying  in  the  artificial  icing  environment  due  to  constant  collective  control 
changes  required  to  fly  formation  and  keep  the  main  rotor  positioned  in  the  artificial 
cloud;  therefore,  an  estimate  of  the  percentage  of  torque  rise  in  the  artificial  icing 
environment  could  not  be  made.  A  fixed  collective  setting  was  used  while  in  the  natural 
icing  environment  permitting  a  more  accurate  correlation  between  torque  increases/ 
decreases  and  rotor  blade  ice  accretion/shedding.  The  largest  torque  rise  was  observed 
in  natural  icing  conditions  at  0.5  gm/m^  LWC  and  -4.0“C;  however,  major  engine  damage 
occurred  during  this  flight  due  to  ice  ingestion  from  a  rotor  ice  shed  as  discussed 
later.  Turbine  gas  temperature  (TGT)  remained  within  the  normal  continuous  limits 
during  power  increases  at  test  gross  weights  and  altitudes.  However,  at  heavier  gross 
weights  in  similar  icing  conditions,  the  TGT  might  rise  to  the  30-minute  limit  range 
or  could  reach  the  maximum  TGT  limit,  resulting  in  loss  of  rotor  speed. 

The  UH-60A  unheated  droop  stops  and  flap  restrainers  were  evaluated  throughout 
the  icing  tests  for  proper  positioning  during  main  rotor  shutdown.  Droop  stops  freezing 
in  the  fly  position  allow  excessive  blade  droop  during  engine  shutdown.  This  occurred 
on  several  natural  icing  flights  where  the  droop  stops  were  not  heated.  This  reduced 
airframe  and  blade  clearance,  and  could  cause  the  blades  to  strike  the  fuselage  or 
ground  personnel  especially  while  shutting  down  during  gusty  wind  conditions. 

The  aircraft  sustained  damage  during  flights  under  both  artificial  and  natural 
icing  conditions.  During  an  artificial  icing  flight  at  0.49  gm/m^  LWC  and  -S-O^C,  a 
tail  rotor  blade  tip  cap  was  damaged,  requiring  replacement.  During  another  artificial 
icing  flight  at  0.5  gm/ra3  LWC  and  -12.5WC,  the  white  strobe  portion  of  the  upper 
anticollision  light  was  broken  by  ice  shed  from  the  main  rotor.  The  shattering  glass 
from  the  anticollision  light  was  thrown  into  the  tail  rotor  blades  causing  damage  to 
the  leading  edge  of  all  four  blades;  and,  the  tail  rotor  gear  box  fiberglass  cowling 
was  hit  by  ice  shed  from  the  main  rotor  causing  a  dent  and  split  which  required  repair 
of  the  cowling. 

The  final  test  flight  was  in  natural  icing  conditions  of  0.5  gm/m^  LWC  and  -4.0UC. 
A  17  percent  torque  rise  per  engine  occurred  after  the  aircraft  had  been  in  the  icing 
environment  13  minutes.  At  29  minutes,  a  main  rotor  ice  shed  occurred  and  torque 
decreased  to  the  preimmersion  trim  power  required  for  cruise  (collective  fixed). 
Within  5  minutes  after  this  shed,  the  torque  had  increased  14  percent  per  engine  with 
random  main  rotor  ice  sheds  occurring  every  3  to  5  minutes,  resulting  in  torque 
decreases  of  3  to  4  percent.  No  significant  increase  in  vibration  level  was  noted 
during  the  ice  sheds.  After  43  minutes  in  the  icing  condition,  torque  was  18  percent 
above  trim  preimmersion  cruise  power.  At  this  time,  ice  was  shed  from  the  main  rotor 
and  was  ingested  into  the  No.  2  engine,  causing  a  rumble,  similar  to  that  of  a  compres¬ 
sor  stall,  accompanied  by  a  high  pitched  squeal  and  TGT  increase  of  approximately 
40°C.  The  icing  condition  was  exited  immediately  and  the  aircraft  was  landed  at  an 
outlying  airport.  This  flight  produced  the  highest  torque  rise  and  most  costly 
aircraft  damage  of  any  icing  condition  tested.  A  borescope  inspection  revealed  major 
damage  to  the  compressor  section  of  the  No.  2  engine  requiring  replacement. 

The  UH-60  apparently  has  some  capability  to  operate  in  light  icing  conditions 
without  an  ice  protection  system  on  the  main  rotor  system.  The  rotor  system  accreted 
ice  and  self  shed.  Power  required  for  flight  increased  resulting  in  range  degradation. 
Vibration  levels  increased  but  were  not  excessive.  The  aircraft  handling  qualities 
and  vibration  levels  were  acceptable  throughout  the  limited  artificial  and  natural 
icing  conditions  tested.  The  UH-60A  demonstrated  safe  operation  in  light  icing  condi¬ 
tions  up  to  and  including  0.3  gm/m3  LWC  without  operating  the  blade  deice  system. 
However,  without  an  ice  protection  system  to  control  the  time  and  size  of  ice  sheds, 
the  amount  of  aircraft  damage  was  increased.  This  translates  into  a  higher  operating 
cost  required  to  fly  unprotected  rotor  systems  in  a  light  icing  environment.  (Ref  3) 

4.  ICE  SHAPES  AND  PERFORMANCE  DEGRADATION 

The  Applied  Technology  Laboratory  (ATL) ,  Research  and  Technology  Laboratories, 
US  Army  Aviation  Research  and  Development  Command  (AVRADCOM) ,  and  NASA  Lewis  Research 
Center  (NASA)  are  jointly  undertaking  a  program  to  predict  the  performance  penalties 
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associated  with  helicopter  operations  in  icing  conditions.  The  initial  phases  of  the 
ATL/NASA  effort  requires  gathering  hover  performance  data  with  both  clean  and  iced 
rotor  blades,  and  documenting  the  topography  of  the  ice  accretion  on  the  rotor  blades. 
AVRADCOM  tasked  the  USAAEF'A  to  conduct  the  hovering  flight  tests  on  a  UH-1H  at  the  NRC 
Icing  Spray  Rig. 

The  objective  of  this  test  was  to  gather  comparative  hover  performance  and  blade 
surface  topography  data  for  the  UH-1H  helicopter  with  both  clean  and  iced  rotor  blades. 
Documentation  of  the  ice  accretion  shapes  is  to  be  accomplished  by  NASA. 

The  test  conditions  were  at  temperatures  ranging  from-3°C  to  -21.5°C  for  a  LWC  of 
0.4  gm/m^,  -8.7  and  -7.5  at  0.25  gm/m^,  and  -19°C  for  0.7  gm/m^.  The  test  technique 
was  to  obtain  hover  data  using  free  flight  method  prior  to  entering  the  cloud.  The 
free  flight  technique  required  variation  of  gross  weight  and  rotor  speed.  Data  was 
obtained  with  the  aircraft  pointed  into  the  wind,  at  a  skid  height  of  50  ft  (15.2  m) . 

The  test  aircraft  was  then  hovered  with  the  main  rotor  immersed  in  the  cloud. 
Initially,  the  advice  of  experienced  spray  rig  operators  was  the  primary  method  used 
to  determine  the  amount  of  ice  accreted  on  the  main  rotor  prior  to  spontaneous  shedding. 
As  experience  was  gained  test  team  members  were  able  to  identify  the  optimum  immersion 
t  ime . 

After  the  rotor  was  iced  the  aircraft  exited  the  artificial  cloud  and  free  hover 
performance  data  repeated.  The  aircraft  was  moved  to  the  vicinity  of  the  ice  documen¬ 
tation  station  which  was  within  300  ft  (91.4  m)  of  the  spray  rig  and  shut  down.  The 
rotor  was  stopped  using  a  rotor  brake  applied  so  as  to  smoothly  stop  the  rotor.  Just 
prior  to  the  rotor  stopping,  the  rotor  brake  was  released  so  that  backlash  of  the 
rotor  drive  train  would  not  cause  ice  to  shed  from  the  blades. 

The  Aeronautical  and  As t ronaut  ica 1  Research  Laboratory  of  the  Ohio  State  University 
(AARL-OSU)  was  responsible  for  all  ice  shape  documentation.  Main  rotor  ice  accretion 
was  documented  using  the  following  techniques: 

a)  Molds  of  the  entire  rotor  ice  accretion. 

b)  Steroscopic  photographs  of  the  entire  rotor  ice  accretion. 

c)  Tracings  or  photographs  with  the  grid  background  of  selected  ice  accretion 
cuts.  (Ref  4) 

The  documentation  station  consisted  of  a  rented  airline  food  service  truck  shown 
in  the  photo  in  figure  10.  The  cargo  area  of  the  truck  was  modified  with  heaters, 
lights,  and  electrical  power  outlets.  The  ability  of  the  cargo  section  to  be  adjusted 
in  height  allowed  for  one  rotor  blade  to  be  almost  completely  inclosed  in  the  cargo 
section  by  backing  the  truck  up  to  the  side  of  the  UH-1H.  This  procedure  allowed 
workers  to  get  close  to  the  iced  rotor  blade,  moderated  the  working  environment,  and 
protected  personnel  from  flying  ice  if  another  pray  rig  test  was  being  conducted 
while  ice  documentation  was  in  progress. 

The  primary  documentation  technique  was  to  mold  the  ice  shape  on  the  leading  edge 
o f  the  rotor  shown  in  the  photo  in  figure  11.  This  allowed  the  most  straight  forward 
method  of  reproducing  the  shapes  for  wind  tunnel  tests.  The  second  most  desirable 
method  was  stero  photography.  Two  cameras  were  used  in  conjunction  with  a  grid  super¬ 
imposed  on  the  ice  contour.  The  final  method  was  to  cut  the  ice  and  then  trace  a 
profile,  obtain  an  impression,  or  photograph  an  inserted  grid. 

The  flying  and  documentation  phase  of  this  program  was  conducted  Januarv  1983 
through  March  1983  and  consisted  of  approximately  10  hours  of  artificial  cloud  time. 
The  wind  tunnel  testing,  computer  coding,  and  analysis  is  still  in  progress. 


5.  CURRENT  STATUS  OF  THE  HELICOPTER  ICING  SPRAY  SYSTEM  (HISS) 

The  US  Army  HISS  is  installed  in  a  JCH-47C.  It  is  designed  to  produce  an  artifi¬ 
cial  icing  cloud  for  inflight  evaluation  of  aircraft  anti-ice  and  de-ice  capabilities. 
The  HISS  consists  of  an  1800  gallon  (6.81  Kg)  water  tank,  plumbing,  pump,  and  spray 
boom.  A  photo  of  the  HISS  is  shown  in  figure  12.  A  schematic  of  the  HISS  is  presented 
in  figure  13  (Ref  5).  The  water  is  pumped  to  manifolds  on  the  boom,  which  distributes 
water  to  nozzles  where  it  is  atomized  by  high  pressure,  bleed  air.  The  JCH-47C  is 
equipped  with  a  Rosemount  sensitive  outside  air  temperature  system  and  a  Cambridge  dew 
point  hygrometer.  A  radar  altimeter  with  rear  facing  antennas  is  used  to  position  the 
test  aircraft  at  the  proper  standoff  distance  o,f  150  ft  (45.7  m)  .  The  HISS  has  been 
operational  since  1974.  It  has  continually  been  in  a  state  of  modification  and 
improvement.  Starting  in  1979  major  modifications  were  initiated  to  improve  the  quality 
of  the  artificial  cloud,  particularly  with  respect  to  the  size  of  the  water  droplets. 

For  1979/1980  icing  season,  the  original  All-American  Engineering  Company  (AAE) 
nozzles  were  replaced.  The  median  volumetric  diameter  (MVD)  of  the  droplets  generated 
by  AAE  nozzles  ranged  from  100  to  300  micron.  The  replacement  nozzles  were  type  125-H 
"Sonicore"  designed  by  Sonic  Development  Corporation.  These  nozzles  produced  a  cloud 
with  a  MVD  more  nearly  approximately  the  natural  environment,  Figure  14  (Ref  6)  depicts 
a  comparison  of  MVD  between  the  artificial  and  natural  clouds.  Cloud  data  was  obtained 


X-5 


by  mounting  particle  measuring  spectrometers  on  a  UH-1H  and  immersing  them  in  the 
artificial  cloud.  All  measured  cloud  parameters  were  derived  from  drop  number  count, 
diameter  classification,  and  size  of  the  air  volume  sampled.  There  were  three  probes 
installed  on  the  IIH-1H;  an  axially  scattering  probe,  a  cloud  particle  spectrometer, 
and  a  precipitation  particle  spectrometer.  The  data  was  analyzed  by  Meterorology 
Research,  Inc.  and  is  presented  in  detail  in  reference  6. 

Two  HISS  configurations  were  evaluated  using  Sonicore  nozzles.  Initially  160 
nozzles  were  installed,  filling  all  available  center  section  locations  and  the  inboard 
three  quarters  of  each  outrigger.  After  three  flights  in  this  conf iguration ,  the 
nozzles  were  removed  from  the  outriggers,  leaving  97  nozzles  installed  in  the  center 
sections  only.  The  outriggers  were  isolated  from  the  boom  air  and  water  supply  by 
metal  plates  bolted  between  the  boom  flanges  at  the  outrigger  junctions.  The  boom 
outriggers  were  left  installed  because  of  boom  dynamics  considerations.  The  remainder 
of  the  flights  used  this  arrangement.  With  160  nozzles,  the  boom  air  pressure  of 
10  psig  (0.703  kg/m^)  was  less  than  the  minimum  needed  for  satisfactory  water  atomiza¬ 
tion.  Reducing  the  number  of  nozzles  to  97  increased  air  pressure  to  a  nominal  20  psig 
(1.406  kg/m^)  which  was  acceptable.  The  pressure  difference  is  attributed  to  the 
resulting  change  in  total  air  orifice  area. 

Several  other  characteristics  of  the  new  system  were  observed  during  operation. 
Flow  blockage  from  residual  water  freezing  in  the  nozzles  was  greatly  reduced  by  routing 
bleed  air  through  both  the  air  and  water  lines  (purge)  from  takeoff  until  actual  start 
of  water  flow.  This  proved  effective  to  temperatures  as  low  as  -20°C,  provided  all 
residual  water  had  first  been  eliminated  from  the  boom. 


For  the  1981/1982  icing  season,  a  solar  T-62T-40C2  gas  turbine  auxiliary  power 
unit  (APU)  was  added  to  increase  air  pressure  available  to  the  nozzles  for  improved 
atomization.  Previously  the  two  main  engines  on  the  CH-47  were  tapped  at  the  engine 
anti-ice  port  for  compressor  bleed  air.  For  purposes  of  safety  and  noise  reduction, 
the  unit  was  inclosed  in  a  stainless  steel  box  with  fiberglass  sound  proofing.  Bleed 
air  from  the  APU  was  ducted  to  a  flow  mixer  which  combined  aircraft  engine  bleed  air 
with  APU  bleed  air.  The  combined  APU  and  engine  bleed  air  enter  the  boom  through 
flexible  tubing  leading  to  the  boom  air  intake  pipes  on  either  side  of  the  cabin. 
Electricajjy-operated  valves  actuated  from  a  single  control  panel  were  installed  in 
the  system  to  control  both  bleed  air  and  water  flow  rates. 


Two  HISS  nozzle  configurations  were  evaluated  after  this  installation.  Initally 
165  Sonicore  nozzles  were  intailed  to  fill  all  usable  locations.  Because  of  air  pres¬ 
sure  and  water  endurance  considerations,  the  nozzles  were  removed  from  the  outriggers 
leaving  97  nozzles  installed  in  the  center  nozzles  only.  The  outriggers  were  isolated 
from  the  boom  air  and  water  supply  in  the  same  manner  as  before.  All  artificial  icing 
tests  were  accomplished  in  this  configuration.  With  165  nozzles,  the  boom  air  pressure 
was  a  nominal  20  psig  (1.406  Kg/m^) .  This  approximates  the  boom  pressure  reported 
in  previous  years  with  only  the  center  boom  sections  operational.  Reducing  the  number 
of  nozzles  to  97  increases  boom  air  pressures  to  between  23  (1.62  Kg/m^)  and  36  psig 
(2.53  Kg/m‘) .  This  increased  pressure  permitted  slightly  better  droplet  atomization 
and  produced  acceptable  cloud  characteristics  at  higher  flow  rates  under  high  relative 
humidity  conditions. 


A  major  problem  encountered  during  these  icing  tests  was  the  formation  of  ice 
masses  ("pops ic les" )  on  the  boom.  These  ice  masses  would  randomly  fall  from  the  boom 
which  posed  a  hazard  to  people  and  equipment  on  the  ground.  Leaking  water  may  also 
increase  the  MVD  of  the  artificial  cloud.  Early  nozzle  configurations  (prior  to 
1980)  suffered  from  this  problem,  but  it  had  nearly  been  eliminated  during  the  past 
two  icing  seasons.  Leakage  now  occurred  where  the  plastic  hoses  attach  to  the  brass 
fittings  on  the  nozzles  and  the  water  manifolds.  The  leaks  were  probably  caused  by 
increased  bleed  air  pressure  and  temperature  from  the  new  APU  during  the  purge  cycle. 
No  suitable  solution  to  this  problem  was  found  during  the  icing  season  and  the  spray 
cloud  was  degraded  because  of  it. 

Another  recurring  problem  with  the  HISS  was  a  difference  in  spray  output  between 
the  upper  and  lower  boom  sections.  Downward  flow  routing  of  water  from  common  sources 
and  a  difference  in  static  head  pressure  due  to  5  foot  (1.*  ml  vertical  separation 
resulted  in  a  visible  more  dense  spray  emanating  from  the  lower  boom.  This  condition 
was  aggravated  by  installation  of  the  bleed  air  APU.  Increased  bleed  air  pressure  and 
temperature  caused  breakdown  of  hoses  and  seals  within  the  boom  which  allowed  air  to 
leak  into  the  water  system.  At  low  and  moderate  flow  rates,  the  spray  from  the  upper 
boom  would  be  intermittent. 


Documentation  of  the  cloud  properties  for  1981/1982  was  conducted  by  a  forward 
scattering  spectrometrlc  probe  (FSSP)  and  a  optical  array  probe  (OAP)  mounted  on  a 
U-21  fixed  wing  aircraft.  The  probes  were  immersed  in  the  artificial  cloud  of  150  ft 
(45.7  m)  behind  the  spray  boom.  Vertical  sweep  measurements  indicated  higher  values 
of  median  volumetric  diameter  (MVD)  in  the  bottom  1/4  of  the  cloud.  This  increase  was 
caused  by  an  absence  of  small  drops  and  not  an  increase  in  the  number  of  large  drops. 
The  reasons  for  this  shift  are  probably  related  to  gravitational  sorting,  bouyancy 
effects  and  differences  in  spray  flow  rate  and  atomization  between  the  upper  and  lower 
booms . 


Figure  15  (Ref  7)  shows  spray  cloud  MVD  as  a  function  of  water  flow  rate.  The 
MVD  data  at  the  lower  flow  rates  fall  between  25  and  40  microns.  MVD  Increased  as 
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water  flow  rate  increased.  With  the  increased  air  supply  available,  MVD  was  not 
expected  to  increase  with  flow  rate.  This  MVD  increase  could  be  caused  by  the  numerous 
air  and  water  leaks  experienced  since  the  installation  of  the  APU. 

Liquid  water  content  (LWC)  was  obtained  from  the  FSSP  and  OAP  systems.  It  was 
backed  up  by  calculated  LWC  based  on  the  true  airspeed,  cloud  size,  and  water  flow 
rate.  The  spray  cloud  is  not  homogeneous.  The  thickest  portion  of  the  cloud  is  just 
below  cloud  centerline  as  shown  in  figure  16  (Ref  7).  The  LWC  of  the  cloud  is  measured 
in  the  thickest  region.  Measured  values  of  LWC  as  a  function  of  water  flow  rate  are 
shown  in  figure  17  (Ref  7).  These  values  are  averages  of  10  second  sample  times  taken 
over  a  one  to  two-minute  immersion.  Scatter  in  the  data  may  be  explained  by  1  gal/min 
resolution  of  the  flow  meter  and  measurement  techniques  (i.e.,  ability  of  the  pilot  to 
maintain  precise  position).  Test  day  relative  humidity  effects  the  LWC  and  MVD.  In 
particular,  low  relative  humidity  decreases  the  LWC  for  a  given  flow  rate  and  increases 
MVD  by  evaporating  the  smaller  droplets. 

For  the  1982/1983  icing  season  several  reliability  and  maintainability  improve¬ 
ments  as  well  as  corrections  to  the  above  mentioned  problems  were  accomplished.  The 
water  jettison  system  was  redesigned,  insulation  was  added  to  improve  crew  comfort, 
the  water  and  air  lines  were  rerouted  to  reduce  freeze  up,  and  a  more  reliable  water 
flow  measurement  system  was  incorporated.  A  new  manifold  system  was  designed  for 
water  distribution  in  an  attempt  to  reduce  leaks  and  "popsicle”  growth.  The  new  mani¬ 
fold  consists  of  stainless  steel  tubing  with  solid  fittings  between  the  nozzles  and 
the  boom  as  shown  in  figure  18  (Ref  8).  This  should  cure  the  external  water  leak 
problem  of  the  spray  boom.  To  equalize  the  flow  in  the  top  and  bottom  spray  booms  a 
flow  divider  was  installed.  Water  to  the  lower  boom  was  routed  down  the  left  boom 
support  and  water  to  the  upper  boom  was  routed  down  the  right  boom  support. 

The  current  US  Army  artificial  icing  capabilities  using  the  HISS  are: 

a)  test  airspeeds  80  to  120  KTAS  (148  to  222  km/hr) 

b)  liquid  water  content  0.25  to  1.0  gm/m3 

c)  temperatures  zero  to  -20°C 

d)  MVD  25  to  65  microns 

e)  Cloud  size  8  by  36  ft  (2.4  by  11  m) 

The  current  system  capabilities  are  limited  by  a  variety  of  factors.  Maximum 
test  airspeed  is  limited  by  engine  power  available.  The  minimum  airspeed  is  limited 
by  rotor  downwash  impingement  on  the  artificial  cloud.  Flow  rates  of  less  than 
0.25  gm/m3  do  not  fully  charge  the  spray  boom  with  water,  and  flow  from  individual 
nozzles  varies.  The  nozzles  are  also  more  likely  to  freeze  at  low  flow  rates.  The 
1  gm/m3  limit  comes  from  the  fact  the  Army  has  no  requirements  for  higher  flow  rates 
because  the  Army  only  qualifies  aircraft  to  fly  into  forecast  conditions  of  moderate 
intensity  or  less.  Additionally,  MVD  increases  significantly  at  higher  LWCs  degrading 
cloud  quality.  Low  humidity  conditions  cause  small  drops  to  evaporate  rapidly  increas¬ 
ing  the  MVD  of  the  cloud  droplets  reaching  the  test  aircraft.  At  temperatures  below 
-20°C  the  water  system  becomes  more  susceptible  to  freezing,  and  crew  comfort  in  the 
open  aft  area  of  the  JCH-47C  becomes  a  problem.  The  current  cloud  size  is  approximately 
8  by  36  ft  (2.4  by  11  m)  .  This  normally  dictates  that  only  a  portion  of  the  test 
aircraft  can  be  immersed  in  the  cloud  at  any  one  time  such  as  rotor  system,  engine 
inlets,  or  fuselage.  Gravitational  sorting  and  other  factors  produce  a  nonuniform 
cloud  profile.  Endurance  of  the  HISS  is  dependent  on  both  fuel  and  water  expenditures 
and  becomes  a  factor  if  long  immersion  times  at  high  LWC  are  required.  There  is  approx¬ 
imately  54  minutes  of  cloud  time  available  at  flow  rate  for  one  gram  per  cubic  meter 
The  HISS  limitation  and  problem  areas  have  been  adequately  documented  and  where 
possible,  corrected.  However,  many  areas  still  remain  which  can  only  be  corrected  by 
a  complete  HISS  redesign  through  future  improvements  which  are  now  being  addressed. 

6.  FUTURE  HELICOPTER  ICING  SPRAY  SYSTEM  IMPROVEMENTS 

Since  1978,  the  US  Army  and  the  FAA  have  cooperated  to  improve  the  capability  of 
the  HISS  by  executing  Interagency  Agreements.  Through  these  cooperate  efforts  signifi¬ 
cant  improvements  have  been  incorporated  on  the  HISS  as  previously  discussed.  While 
the  common  goal  of  an  improved  HISS  exists,  the  current  FAA  certification  requirements 
and  the  US  Army  Airworthiness  Qualification  requiremennts  for  flight  into  icing  condi¬ 
tions  differ  mainly  in  the  severity  of  LWC  (currently  the  FAA  is  3  gm/m3  which  mav  be 
revised  downward  for  altitudes  below  10,000  ft  and  the  US  Army  is  1  gm/m3)  for  the 
helicopter.  Other  parameters,  which  will  be  identified  later,  are  in  general  agreement. 
The  US  Army  does  recognize  a  need  to  flight  test  engine/engine  inlets  and  cowls  to 
3  gm/m3  LWC,  consequently  the  requirement  to  have  a  HISS  capability  to  produce  3  gm/m3 
is  necessary  in  this  case.  Additionally,  it  would  allow  testing  to  greater  LWC  levels 
should  the  need  arise  for  additional  research  and  development  work  and  for  qualification 
requirements  greater  than  1  gm/ra3.  Based  on  known  requirements,  the  US  Army  negotiated 
a  contract  with  the  Boeing  Vertol  company  in  1982  to  conduct  a  design  analysis  to 
determine  the  design  approach  for  an  improved  HISS  in  order  to  achieve  the  following 
spray  cloud  design  goals: 


a)  Liquid  Water  Content  (LWC)  0  to  3  gm/m^ 

b)  Droplet  Size  (medium  volumetric)  20  to  50  microns 

c)  Test  Temperature  Range  0°C  to  -30°C 

d)  Altitude  Range  (Density  Altitude)  0-12,000  ft  (3,658  m) 

e)  Airspeed  Range  60  (97  Km/hr)  to  150  KTAS 

(241  Km/hr  TAS) 

f)  Cloud  Depth  25  ft  (8  m) 

g)  Cloud  Width  75  ft  (23  m) 

h)  Cloud  Spray  Endurance  at  1.0  gm/m^  1  hour  (at  150  KTAS) 

i)  Aircraft  Endurance  for  conditions  above  2  hours 

A  review  of  the  initial  design  analysis  included  air  vehicle  candidate  assessments 
for  the  HISS.  The  candidate  assessments  are  shown  in  figure  19.  Based  on  availability, 
capability  (including  potential  growth)  and  logistical  support,  the  CH-47D  was  selected 
as  the  candidate  air  vehicle  for  the  new  improved  HISS.  Other  candidates  were  elimi¬ 
nated  because  of  inadequate  useful  load,  airspeed  limitation  and/or  avai labi 1 i ty/cos t / 
support  considerations.  In  addition  to  selecting  the  CH-47D  as  the  air  vehicle  for 
carrying  the  HISS,  the  type  of  HISS  was  defined  as  a  palletized  system  (a  conceptual 
design  is  shown  in  figure  20).  The  HISS  could  be  installed  in  the  cabin  area  with  the 
boom  assembly  actuated  through  the  rear  cabin  window,  for  easy  removal  and  reinstalla¬ 
tion  in  another  CH-47C/D  (a  conceptal  design  is  shown  in  Fig.  21).  The  current  JCH-47D 
HISS  configuration  is  one  of  a  kind  with  extensive  structural  modifications  and  aircraft 
hydraulic,  pneumatic,  and  electrical  interfacing.  When  the  current  JCH-47C  is  down 
for  any  reason  so  is  the  HISS  and  the  narrow  window  for  icing  qualification  test 
programs  in  the  winter  is  jeopardized.  A  palletized  HISS  which  can  be  removed  and 
installed  in  another  CH-47D  and  ready  for  operation  within  two  days  eliminates  the 
potential  for  a  lost  icing  qualification  winter  season.  Unfortunately,  achieving 
all  of  of  the  design  goals  may  not  be  technically  feasible  with  the  CH-47D,  and 
prioritizing  design  goals  may  be  required. 

Two  major  problems  exist  on  the  current  JCH-47C  HISS  combination  which  require 
resolution  before  proceeding  to  a  final  design.  One  is  the  nozzle  design  (the  water 
droplet  MVD  is  dependent  on  water/flow  rate)  and  the  second  is  the  distortion  of  the 
cloud  spray  pattern  due  to  vortex  wake  rollup  as  shown  in  figure  22.  The  current 
nozzle  design  is  not  capable  of  varying  water  droplet  size  independent  of  LWC.  A  new 
nozzle  development  effort  may  have  to  be  undertaken  if  a  nozzle  with  this  capability 
cannot  be  found.  The  vortex  wake  rollup  problem  will  be  investigated  during  flight 
tests  by  trailing  smoke  from  the  current  HISS  boom  at  different  heights  in  an  effort 
to  determine  where  the  vortex  wake  will  not  impinge  the  spray  cloud.  The  vortex  wake 
rollup  phenomenon  effectively  limits  the  spray  cloud's  usefulness  to  approximately 
50  ft  (15  m) .  Flight  test  data  is  being  evaluated  to  determine  the  distance  the  HISS 
boom  must  be  extended  from  the  JCH-4-7C  to  eliminate  interference  of  the  vortex  wake 
with  the  spray  cloud. 

During  the  1980/1981  icing  season  artificial  and  natural  icing  tests  were  conducted 
on  the  US  Army's  UH-60A  helicopter  (reference  9).  Several  shortcomings  under  icing 
conditions  were  revealed  and  subsequently  corrected.  One  shortcoming  of  significant 
concern  with  respect  to  the  adequacy  of  the  HISS  to  duplicate  the  natural  environment 
was  the  large  increase  in  power  required  with  ice  accumulation  on  the  main  rotor  system. 
Figure  23  shows  a  time  history  of  the  UH-60A  increase  in  power  required  during  a  deice 
cycle.  An  increase  of  approximately  30%  in  shaft  horsepower  required  between  main 
rotor  deice  cycles  for  relatively  benign  natural  icing  conditions  of  approximately 
0.2  to  0.4  gm/m^  and  -11°C  is  depicted.  These  power  variations  in  level  flight 
represent  an  adverse  impact  on  range  of  10%  or  greater.  This  type  of  increased  power 
requirement  on  the  UH-60A  is  rather  significant  and  was  not  exhibited  behind  the  HISS 
under  artificial  icing  conditions.  Artificial  icing  tests  behind  the  HISS  indicated 
that  for  simlliar  conditions  power  required  increases  only  half  as  much.  Additionally, 
when  flying  the  UH-1H  under  natural  icing  and  artificial  conditions  such  discrepancies 
in  the  power  required  for  similiar  conditions  were  not  evidenced. 

It  is  suspected  that  the  difference  in  the  HISS  water  droplet  MVD  in  coniuction 
with  the  type  rotor  blade  airfoil  section  being  tested  results  in  ice  accretion  shapes 
significantly  different  between  those  shapes  found  in  the  natural  and  those  seen  in 
artificial  environments.  The  difference  in  ice  shapes  was  observed  by  flight  test  per¬ 
sonnel  during  icing  tests.  In  the  artificial  icing  environment,  flight  crews  normally 
observed  a  streamlined  conformal  ice  coating  on  aircraft  airfoil  shapes  under  all  LWC 
and  temperature  conditions.  While  in  the  natural  environment  the  ice  form  shape  was 
normally  nonconforml  and  exhibited  typical  horn  type  protuberences  as  shown  in 
figure  24.  The  rotor  blade  section  of  the  UH-60A  is  an  SC  1095  while  the  UH-1H  is  a 
NACA  0012.  The  SC  1095  represents  an  aerodynamical  ly  more  efficient  blade  than  the 
NACA  0012  and  may  therefore  be  more  adversely  effected  by  icing  conditions.  If  this 
is  the  case  then  the  validity  of  artificial  icing  tests  under  some  conditions  behind 
the  HISS  may  be  reduced.  The  identification  of  such  limitations  relative  to  certifi¬ 
cation  icing  tests  is  essential  to  the  qualification  process. 

AVRADCOM  is  currently  conducting  flight  research  to  identify  and  document  the 
differences  in  the  ice  accretion  shapes  in  the  HISS  artificial  environment  and  the 
natural  environment.  A  three  phase  program  will  be  conducted  to  accomplish  the 
following : 


a)  Phase  1.  Verification  and  comparison  of  the  cloud  parameter  measurements 
between  the  USAAEFA  U-21A  installed  system  and  the  US  National  Center  for  Atmospheric 
Research  (NCAR)  similiarly  equipped  Beech  King  Air. 

b)  Phase  2.  U-21A  natural  icing  tests  in  which  the  airplane  is  equipped  with  the 

cloud  parameter  data  measurement  system  and  installed  airfoil  sections. 

c)  Phase  3.  U-21A  artificial  icing  tests  in  which  the  airplane  is  equipped  with 

the  cloud  parameter  data  measurement  system  and  installed  airfoil  sections. 

Phase  1  will  be  conducted  with  the  11  —  2 1 A  and  Beech  King  Air  being  flown  in  forma¬ 
tion  or  close  proximity  under  natural  icing  conditions  to  verify  that  the  cloud  para¬ 
meter  measurements  obtained  in  terms  of  LWC ,  water  droplet  MVD ,  and  distribution 
characteristics  are  comparable.  This  comparison  would  insure  that  the  values  derived 
could  be  used  in  the  same  data  base.  Data  compared  will  be  obtained  from  the  Forward 
Scattering  Spectrometer  Probe  (FSSP) ,  an  Optical  Array  Cloud  Droplet  Spectrometer 
Probe  (OAP) ,  Rosemount  OAT  sensor,  Cambridge  hygrometer,  Leigh  MK-10  ice  detector  and 
the  Small  Intelligence  Icing  Data  Systems  (SUDS).  Photos  of  the  equipment  are 
presented  in  figures  25  and  26. 

Phases  2  and  3  will  consist  Initially  of  identifying,  designing  and  fabricating 
full  scale  and  partial  scale  models  of  the  UH-60A  SC  1095  and  UH-1H  NACA  0012  blade 
section  (the  span  is  yet  to  be  determined).  These  sections  will  be  mounted  externally 
on  the  U-21A  in  the  free  airstream  and  be  adjustable  for  angle  of  attack.  Heat  will 
be  applied  to  remove  ice  periodically  so  that  different  test  conditions  can  be  evaluated 
expeditiously.  Photographic  documentation  of  the  ice  shape  during  buildup  will  he 
taken  continuously.  Figure  27  shows  a  conceptual  design  of  the  airfoil  sections  mounted 
on  the  U-21A.  The  U-21A  will  be  flown  behind  the  HISS  in  artificial  icing  conditions 
and  then  in  natural  icing  conditions  for  an  extensive  matrix  of  liquid  water  content 
and  temperatures.  Attempts  will  be  made  to  correlate  the  ice  shape  obtained  behind 
the  HISS  on  an  airfoil  section  and  in  natural  ice  by  scaling  using  the  similitude  laws 
presented  in  reference  10.  Some  difficulty  in  perfect  duplication  of  the  ice  shapes 
is  expected  since  the  scaling  will  be  based  on  several  variables  which  must  be  obtained 
simultaneously  in  the  natural  as  well  as  artificial  envrionment.  The  variables  will 
include  LWC,  water  droplet  size,  ambient  temperature ,  time  in  the  icing  environment 
and  velocity. 
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Fig.  1.  US  Army  Accepted  Atmospheric  Criterion 


Fig.  4.  Nondimensional  Hover  Performance 


Mg.  Pneumatic  Boot  Cross  Section  (Inflated) 


Fig.  b.  Level  Flight  Performance 


UH-1  in  Artificial  icing  Cloud  Fig.  7.  Ice  on  Unprotected  Portion  of  Rotor  Blade  and 

Ice  Removed  by  Pneumatic  Boot  Protected 
Portion  Exposure  Time  10  Min. 
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Fig.  8.  Residual  Ice  on  Pneumatic  Deice  Boot 
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Fig.  9.  Specific  UH-60  Test  Conditions 


Documentation  Station  and  Test  Aircraft 


Fig.  II.  Inside  Documentation  Station 
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Fig.  12.  Helicopter  Icing  Spray  System  and  Test  Aircraft 
in  Artificial  Ice  Cloud 


Fig.  13.  Helicopter  Icing  Spray  Systems  Side  and  Rear  View  Schematics 
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NOTES:  1.  Present  MISS  con-f  i  qurat  ion  Q?  Sonuorp  nozzles  installed  on 
boom  center  sections  only 

2.  Previous  mJSS  configuration  SI  All  American  Engineering 
Co.  noz/les  installed  on  boom  center  se;tions  and  i*utnqq«-»s 

3  Data  taken  at  90  MAS 

4.  MISS  cloud  depth  estimated  as  0  ft  in  present  configuration. 
10  ft  m  previous  configuration 

6.  MVO  measured  w'th  Particle  Measuring  Spectrometers  Furnished 
by  MR! 

b.  Ranges  for  mJSS  MvD  values  are  based  on  combined  vertical 
sweep  data  from  several  flights 
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Fig.  21.  Conceptual  View  of  Selected  CH-47C/D  HISS  Air  Vehicle 


Fig.  22.  HISS  Cloud  Spray  Pattern  Due  to  Vortex  Wake  Rollup 


A1  RURAL  1  OPERATIONS  FROM  AIRFIELDS  WITH  SPECIAL  UNCONVENTIONAL 
CHARACTERISTICS 


par 

O. Robert 
Service  Essais 
Section  Avions 
Centre  d'Essais  en  Vo! 

13800  Istres-Air 

1 )  INTRODUCTION  France 

Devant  le  dkveloppement  du  transport  type  "commuter"  et  la  mise  en  service  a  la  fin 
des  annkes  60  d'avions  de  masse  infkrieure  k  5700kg  mais  d'une  capacity  allant  jusqu'k 
20  passagers  les  autoritks  de  diffkrents  pays  ont  estimk  devoir  modifier  les  rkglements 
de  navigability  et  les  rkglements  opkrationnels  pour  assurer  k  ce  type  de  transport  un 
niveau  de  skcuritk  comparable  a  celui  du  transport  akrien  classique  (SFAR  23  et  appendix 
A  de  la  FAR  135  aux  Etats-Unis,  Arrktk  du  25  Novembre  1974  en  FRANCE  par  exemple). 
L'essentiel  de  ces  nouvelles  dispositions  concerne  1 ' exploitation  des  avions  multimoteurs 
de  masse  infkrieure  k  5700kg  amknages  pour  le  transport  de  10  passagers  et  plus  pour 
lesquels  il  faut  couvrir  la  panne  de  moteur  au  dkcollage.  Ceci  implique  : 

.  De  tenir  compte  de  la  distance  d ‘ accklkration-arrkt 

.  De  limiter  eventuel lement  la  masse  maximale  au  dkcollage  afin  d'assurer  une  trajectoire 
au  2e  segment  de  pente  minimale  2  p.cent  avec  un  moteur  hors  de  fonctionnement . 

Deux  types  d ' exploitat ions  envisagkes  en  FRANCE  sur  des  pistes  courtes  dkpourvues  de  prolon- 
gement  d' arret  ktaient  incompatibles  avec  la  premikre  exigence  : 

.  L ' exploitat ion  sur  certains  terrains  Outre  mer  situks  en  gknkral  sur  des  Hots 
.  L‘ exploitation  sur  altiports  dkneigks  ( cf  figure  1)  ou  1 ' acckleration  arret  est 
impossible  dks  que  1' avion  se  trouve  engagk  dans  la  pente,  qui  peut  atteindre  - 
20p.cent  comme  a  COURCHEVEL. 

Pour  ces  exploitations  1 ' implantation  de  pistes  sufisamment  longues  pour  satisfaire  les 
exigences  de  l'arrete  du  25  Novembre  1974  n'est  pas  possible,  soit  k  cause  du  manque 
d'espace  soit  parce  qu'il  est  prkfkrable  de  privilkgier  d'autres  facteurs  favorables 
k  la  skcurite  comme  1 ' axe  de  piste  par  rapport  aux  vents  dominants  ou  par  rapport  aux 
obstacles.  Ces  pistes  sont  par  contre  pourvues  d'excellents  prolongements  dkgagks.  Pour 
continuer  k  exploiter  sur  ces  terrains  des  derogations  etaient  necessaires.  Elies  devaient 
etre  justifikes  par  des  conditions  techniques  d' exploitation  garantissant  un  niveau  de 
skcurite  satisf aisant.  Pour  que  ce  niveau  de  skcurite  reste  equivalent  k  celui  visk  par 
l'arrete  du  25  Novembre  1974  il  restait  nkcessaire  d'ktablir  de  nouvelles  rkgles  couvrant 
la  panne  d ' un  moteur  au  dkcollage.  Il  fallait  en  outre  definir  de  nouvelles  prockdures 
et  s'assurer  que  les  exploitants  avaient  les  structures  adequates  pour  les  appliquer.  Ce 
travail,  coordonk  par  la  DGAC  (Direction  Gknerale  de  1' Aviation  Civile),  a  etk  effectuk 
en  cooperation  avec  le  CEV  (Centre  d’essais  en  vol)  1 ' OCV  (Organisme  du  Controle  en  vol 
de  la  DGAC)  et  la  compagnie  AIR  ALPES.  La  presente  communication  rend  compte  des  ktapes 
techniques  qui  ont  ktk  nkcessaires  pour  klaborer  ces  nouvelles  rkgles. 

2)  HISTORIQUE 

-  11  Aout  1962  :  Arretk  dkfinissant  les  conditions  techniques  d'emploi  des  avions  de 

transport  public. 

-  25  Novembre  1974  :  Aretk  dkfinissant  les  nouvelles  conditions  techniques  relatives  aux 

performances  exigkes  pour  1 ' exploitation  des  avions  de  transport  public. 

-  17  Dkcembre  1975  :  Autorisation  d 1 exploitat ion  par  AIR  ALPES  des  altiports  de 

COURCHEVEL,  MEGEVE. 

-  16  au  26  Octobre  1978  :  Essais  en  vol  sur  pistes  plates  ou  lkgkrement  en  pente 

(MENDE  =  4%)  avec  un  DHC6-300  :  29h  de  vol. 

-  17  au  27  Spetembre  1979  :  Essais  en  vol  sur  altiports  avec  un  DHC6-300  :  19h  de  vol 

70  dkcollages. 

Nota  :  7  pilotes  (3CEV,  2DGAC,  2  AIR  ALPES)  ont  participk  aux  essais  en  vol  ci-dessus. 

-  78/79  Mise  au  point  d ' un  modkle  de  calcul  des  performances  de  roulement  du  DHC6-300 

sur  un  calculateur  IRIS  80  de  la  DGAC. 

-  Juillet  1980  -  Rapport  d’essais  en  vol. 

-  18  Aout  1982  -  Autorisation  d ' exploitation  du  DHC6-300  sur  pistes  courtes  par  AIR 

CALEDONI E . 

-  17  Novembre  1982  -  Autorisation  d ' exploitat ion  du  DHC6-300  sur  pistes  courtes  par  AIR 

GUADELOUPE. 

-  18  Dkcembre  1982  -  Autorisation  d' exploitation  du  DHC6-300  sur  altiports, 

conformkment  aux  recommandations  ci-dessous,  par  TAT. 


3  )  PROBLEME  POSE  PAR  LES  EXIGENCES  AU  DECOLLAGE  (cf  Figure  2) 

Pour  un  avion  de  masse  5700Kg  amknagk  pour  transporter  10  passagers  ou  plus  la 
longueur  de  piste  nkcessaire  doit  etre  telle  que  : 

L  roulement  (AEO)  jusqu'k  Lift  off  4  t>  runway 
L  50ft  (AEO)  ^  L  runway  +  clearway 

LASD  (Acceleration  stop  distance)  ^  L  runway  +  stopway  avec  Vl/VLOF^  1,1  VMCA  ou 
1 , 1 VS  ( le  plus  grand)  et  V2  >  1.1VMCA  ou  1 , 2VS  (le  plus  grand) 

Exemple  pour  un  DHC6-300  :  m  »  5670kg  ISA  +  25*  Z  =  0  sans  vent  et  sur  piste  plate. 
Llof  (AEO)  -  350m  VI  =  VLOF  »  74,5Kt 

L50f t  (AEO)  =  548m  V2  =  81  Kt 

LASD  »  786m 
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Dans  ces  conditions  la  pente  an  deuxi&me  segment  avec  un  moteur  en  panne  (OEI)  =  2,8% 

(Cette  valeur  montrant  an  passage  que  le  DHC6-300  n'est  prat iquement  jamais  limits 
poids-pente ) . 

11  est  clair  que  sur  un  terrain  sans  stopway  la  condition  qui  dimensionne  la  longueur 
de  piste  n^cessaire  au  decollage  est  LASD. 

On  peut  faire  au  passage  trois  remarques  : 

-1-  La  r^glementation  n‘ impose  pas  de  condition  piste  associee  au  decollage  avec  un 
moteur  en  panne.  Ceci  se  justifie  pas  le  choix  d'une  VI  6lev6e.  Dans  notre  exemple  la 
distance  jusqu'au  LOF  avec  panne  moteur  k  VEF  =  72,5kt  ( soit  1"  avant  VI)  serait  de  510m 
soit  nettement  inf4rieure  k  la  longueur  exig6e  par  la  condition  Acc4ieration-Arret  786m. 

-2-  Pour  1' Equipage  la  procedure  est  simple  car  bas4e  sur  la  connaissance  de  deux 
vitesses  VI  et  V2  ce  qui  revient  a  faire  la  rotation  a  VI. 

-3-  Pour  le  postulant  les  essais  en  vol  de  certification  sont  simplifies  par  rapport  aux 
avions  certifies  FAR  25. 

.  Les  mesures  des  distances  de  decollage  OEI  ne  sont  pas  exigfees 

.  II  n'y  a  pas  de  conditions  associ4es  au  choix  de  VR  (cas  abusifs,  essais  de  VMU ) 

.  La  mesure  de  VMCG  (minimum  control  speed  ground)  n'est  pas  exig4e. 

1 'exemple  pr6c6dent  montre  clairement  que  pour  d4coller  sur  une  piste  plus  courte,  tout 
en  assurant  1 ' acceleration  arret  en  cas  de  panne  moteur  avant  VI,  il  faut  choisir  une 
vitesse  de  decision  plus  faible,  introduire  la  notion  de  VR  Vitesse  de  rotation  au 
(Jecoilage  qui  sera  sup4rieure  a  VI  et  balancer  la  piste  entre  la  distance  de  decollage 
et  la  distance  d ' acceleration  arret,  ce  qui  n'etait  pas  le  cas  precedemment .  La  distance 
de  decollage  a  considerer  doit  etre  celle  avec  un  moteur  en  panne. 

4  )  PROCEDURE  PROPOSEE  SUR  PISTE  PLATE  ( cf  figure  3) 

Des  discussions  prealables  entre  la  DGAC  { SFACT  et  OCV)  et  le  CEV,  il  est  ressorti 
que  la  procedure  de  decollage  devait  etre  bas4e  sur  les  hypotheses  suivantes  : 

(1)  Ne  considerer  comae  devant  etre  4gale  4  la  longueur  de  piste  que  la  phase  roulement 
au  sol  du  decollage.  La  partie  en  vol,  allant  de  1 ' endroit  ou  1 ' avion  quitte  le  sol 
(Point  de  LOF  =  lift  off)  jusqu'au  franchissement  des  50ft  reglementaires,  4tant  alors 
couverte  par  le  prolongement  d4gag4  d' obstacle  que  constitue  par  hypothese  le  terrain 
concerne  par  la  derogation. 

(2)  D4finir  une  vitesse  de  panne  moteur  (VEF  =  engine  failure)  inferieure  a  VR  telle  que 
la  longueur  de  piste  permette  : 

-  soit  d'acceierer  tous  moteurs  en  fonctionnement  jusqu'a  VEF,  puis  avec  un  moteur  en 
panne  de  VEF  a  VLOF  (Vitesse  de  decollage). 

-  Soit  d'acceierer,  tous  moteurs  en  fonctionnement  jusqu'a  VEF  puis  d'arreter  l'avion 
d4s  reconnaissance  de  la  panne  (avec  unAt  =  1"  entre  EF  et  1' action  sur  les  freins). 

(3)  Pour  pouvoir  poursuivre  la  course  au  decollage  en  securite,  il  est  necessaire  de 
pouvoir  garder  le  controle  au  sol  avec  un  moteur  en  panne  4  VEF.  La  determination  de  la 
vitesse  minimale  de  controle  au  sol, VMCG,  n'est  pas  exig4e  lors  des  certifications 
actuelles  SFAR  23,  mais  1 ' est  par  contre  en  FAR  25  c’est  4  dire  pour  les  avions  de  plus 
de  5  700kg  et  est  demontree  en  utilisant  les  seules  gouvernes  aerodynamiques .  La  demons¬ 
tration  peut  done  etre  effectu4e  par  un  seul  pilote.  Il  est  done  propose  de  prendre  les 
memes  demonstrations  et  exigences,  e'est  a  dire  VEF  ^  VMCG  (gouvernes  aerodynamiques). 

(4)  Garder,  en  les  justifiant  par  les  essais  les  vitesses  de  decollage  pr4vues  dans 
l'arrete  soit  s 

VLOF  >  1,1  VMCA  ou  1,1  Vs . 

V2  f  1,1  VMCA  ou  1,2  Vs . 

(5)  Garder  les  limitations  poids-pente  actuelles  (0%  au  premier  segment,  2%  au  deuxieme 
segment) . 

Les  questions  posees  par  la  proposition  prec6dente  sont  •. 

-  Determination  de  VMCG 

-  Determination  des  performances  de  roulement  avec  un  moteur  en  panne 

-  Justification  du  choix  de  VR/VLOF 

-  Marges  k  prendre  au  roulement  pour  tenir  compte  de  la  dispersion  operationnel le . 

-  Definition  du  clearway  pour  couvrir  la  distance  de  decollage  un  moteur  en  panne 

jusqu'A  50ft. 

5  )  CAS  PARTICULIER  DES  ALTIPORTS  (cf  figure  4) 

5.1  -  La  decision 

Sur  altiports  l'extreme  rapidit6  du  deroulement  des  sequences  de  decollage  et  la 
faible  probabilite  de  pouvoir  arrSter  l'avion  une  fois  qu'il  est  engage  dans  la  pente 
rendent  inadapt4e  la  notion  class ique  de  VI .  A  COURCHEVEL  par  exemple  l'avion  est  d4j4  a 
35Kt  dans  la  pente  k  -20%.  Laisser,  4  cet  instant,  le  choix  au  pilote  entre  la  continuation 
du  decollage  ou  son  interruption  risque  de  conduire  a  un  freinage  tardif  et  done  a  une 
sortie  de  piste.  Pour  4viter  toute  confusion  l‘4quipage  doit  6tre  programme  pour  le 
decollage  d4s  le  passage  de  la  cassure  de  pente  -  et  k  la  notion  de  vitesse  de  decision 
il  faut  substituer  la  notion  de  point  de  decision.  (Des  essais  en  vol  4ffectu4s  avec  un 
Breguet  941  suggeraient  meme  de  prendre  VI  «  5” scf  reference  1).  Sur  la  pluspart  des 
bimoteurs  actuels  il  est  illusoire  d'esperer  une  VMCG,  demontree  avec  les  seules  gouvernes 
aerodynamiques,  inf4rieure  k  50Kt.  Une  possibilite  d’eviter  la  perte  de  contr6le  entre 
le  point  de  decision  (  2"  30Kt  k  COURCHEVEL)  et  la  VMCG  est  d'autor  iter,  r6glementairement, 

1 ' ut i 1 isat ion  de  la  dirigeabil it4  pour  garder  le  contrSle  de  l'avion  au  sol. 

5.2  -  Distance  de  decollage  et  Pente  de  mont6e  apr4s  decollage  (ler  et  2eme  segment) 
Les  altiports  sont  en  g6n4ral  assez  hauts,  6800ft  pour  COURCHEVEL,  et  situ6s  au  dessus 

de  valiees  d6gagees  et  en  cas  de  panne  moteur  le  terrain  de  degagement  est  situ4  dans  la 
plaine.  Ces  facteurs  rendent  inadequate  les  criteres  habituels  utilises  sur  piste  plate 
i  La  distance  de  decollage  k  50ft  n'a  pas  de  sens  operationnel.  Les  exigences  de 
mont4e  au  2eme  segment  (2%)  avec  un  moteur  en  panne  peuvent  etre  inutilement  p4nal i santes . 


5.3  -  Conq&res  de  neige 

En  hiver  les  altiports  sont  d&neigfes  mais  il  peut  substituer  en  bout  de  piste  des 

cong&res  pouvant  atteindre  Ira. 

5.4  -  Derogation  sur  altiports  (cf.  figure  5) 

Des  cons ide rat  ions  pr?c?dentes,  il  ressort  que  la  procedure  de  decollage  doit  etre 
bas6e  sur  les  hypotheses  suivantes  : 

(1)  D^finir  un  point  de  decision  situ4  a  la  cassure  de  pente  et  tel  que  la  longueur  de 
piste  permette  d‘acc4l4rer  tous  raoteurs  en  fonct ionnement  jusqu'4  VEF  puis  avec  un 
moteur  en  panne  de  VEF  4  VLOF  et  de  passer  le  seuil  de  piste  avec  une  marge  suffisante 
( > 1  m  si  neige) 

(2)  Poursuivre  le  d&collage  en  s4curit£  en  d6montrant  que  1' avion  est  controlable  a 
nartir  de  VEF  en  utilisant  les  gouvernes  aerodynamiques  et/ou  la  di riqeabi lit4 

VEF  VMCG  ( DIRIGEAB ILITE )  ~  ~  “ 

(3)  Garder  les  vitesses  de  decollage  pr4vues  par  l'arret£  soit  : 

VLOF  1,1  VMCA  ou  1,1VS 

V2  V  1.1  VMCA  ou  1, 2  VS 

(4)  Ne  pas  reglementer  a  priori  les  trajectoires  de  d£col lage  et  les  pentes  de  nont£e 
apres  le  passage  du  seuil  avant  d'avoir  analyse  les  resultats  d'essais. 

Les  questions  posees  etant  : 

.  Determination  de  VMCG  avec  di r igeabi li t£ 

.  Determination  des  performances  de  roulement  avec  un  moteur  en  panne 

.  Justification  de  VR/VLOF 

.  Marges  a  prendre  au  roulement  pour  passer  le  seuil  de  piste  a  une  hauteur  suffisante 

.  Propositions  de  critferes  au  d4collage  aprfes  le  seuil  de  piste 

6)  APPLICATION  DE  LA  DEROGATIOM  AU  DHC6- 300 


Afin  de  verifier  les  procedures  sp6ciales  propos4es,  en  connait!  >  les  limites  et 
repondre  aux  questions  nouvelles  poshes,  des  essais  en  vol  avec  un  avion  representati f 
instruments  etaient  nScessaires.  Il  a  etS  admis  avec  la  DGAC  de  limiter  dans  un  premier 
temps  cette  procedure  au  DHC6-300  pour  plusieurs  raisons  : 

-  Cet  appareil  est  1' avion  le  plus  repandu  pour  1 ' exploitat ion  outremer  du  fait  de  ses 
caracteristiques  rustiques  et  de  ses  bonnes  performances  qui  ont  fait  qu'il  etait  adaptS 
aux  conditions  locales  d ' uti lisat ion  d'une  infrastructure  reduite  lorsque  la 
reglementation  en  vigueur  etait  celle  de  l'arrete  du  2  Aout  1962. 

-  Le  DHC6-300  est  un  avion  theor iquement  bien  connu  du  fait  des  etudes  men&es  par  le 
bureau  "Technique  utilisation"  pour  1 ' ut il isation  des  altiports. 

-  Une  recherche  des  caracteristiques  et  des  performances  detail lSes  de  1’ appareil,  des 
contacts  avec  de  HAVILLAND  of  CANADA,  ont  permis  d'Slaborer  des  programmes  sur  HP  65  et 
IRIS  80  couvrant  certaines  performances  de  1' avion  en  fonction  de  plusieurs  paramStres 
du  domaine  du  vol  et  capable  de  fournir  les  donnSes  necessaires  S  1' etude  presente. 


6.1  -  Caracteristiques  du _ 

Cet  avion- Stant  dSjS  bien  connu,  seules  les 
interessant  l ' experimentation  sont  rappelees  ci 
Limitations 

Masse  maximale  au  dScollage  5  670  kg 

Masse  maximale  h  l ' atterrissage  5  580  kg 


caracteristiques 

-dessous 


particul ieres 


VMCA  Volets  10*  =  66  kt 
Puissance  maximale  Decollage  =  620  HP 
et  Maxi  Continu 
Couple  maximum  =  50  psi 

Volets  :  la  configuration  de  decollage  est  normalement  10*,  la  configuration 
d k atterrissage  est  normalement  37*5  mais  il  est  possible  d’afficher  des  positions  de 
volets  intermSdiaires . 

Le  train  est  fixe  : 

-  Ce  qui  a  facility  1 ' implantat ion  et  le  cheminement  de  1 ’ instal lat ion  d'essais 

-  A  meme  performance  au  2Sme  segment,  la  performance  au  d&collage  d ' un  avion  S  train 
fixe  est  done  meilleure  ce  qui  est  favorable  a  la  sS~uritS  des  essais. 

Performance  : 

L' avion  est  motorisS  par  deux  turbopropulseurs  a  turbine  libre  PT6-A27  de  620  HP.  Il 
s'agit  de  moteurs  dStarSs  pour  lesquels  la  puissance  est  d'abord  limitSe  par  1‘arbre  de 
sortie  et  non  par  la  puissance  thermique  de  la  turbine  motrice.  Ceci  permet  de  conserver 
la  puissance  nominale  jusqu'S  des  tempSratures  et  altitudes  Slevees  ce  qui  est 
particuliSrement  intSressant  outremer  et  en  montagne. 

D'une  manifere  gSnSrale  la  performance  est  brillante.  On  peut,  par  exemple,  encore 
dScoller  la  masse  maximale  S  Z  «  6000  ft  et  Ts  =  19*C  (standard  +  16*C) 


DiriqeabilitS  s 

L' avion  eat  4quip6  d'une  dirigeabi 1 i tS  qui  est  commandSe,  hydraul iquement ,  par  un  levier 
situS  sur  le  volant  de  la  place  gauche,  ce  qui  permet  un  transfert  dirigeabilitS  - 
gauchissement  rapide.  Il  n'est  nSanmoins  pas  possible  &  un  seul  pilote  d'utiliser 
simultanSment  les  deux  commandes. 

Instruments  moteurs  s 

Le  couple  est  le  paramStre  opSrationnel  que  le  pilote  doit  afficher,  en  fonction  des 
conditions  Zp  et  Ts  du  jour,  pour  observer  les  limitations  moteurs  :  couple  max,  T5  max, 
NG  max . . . 

La  puissance  dSveloppSe  sur  l'arbre  de  sortie  est  donnSe  par 


P  *  12,88  X  Torque  (psi)  x  Np  % 

Toi5“ 


A 


Np  *  96  <  au  dScollage 


g-4 


Drapeau  automatique  : 

Chaque  h£lice  est  6quipee  d'un  dispositif  de  mise  en  drapeau  automatique. 

Simulation  des  performances  de  mont6e  : 

Les  performances  peuvent  facilement  etre  simul&es  k  partir  <iu  param^tre  de  conduite  :  le 
couple.  Cete  simulation  permettait  de  balayer,  4  titre  d‘£tude  g£n£rale,  la  plage  des 
conditions  poids-pente  pr&visibles  pour  les  avions  susceptibles  d'etre  concern^s  par  la 
derogation . 

Simulation  de  la  panne  moteur  : 

La  turbine  et  1 1  he 1 ice  6tant  libre,  on  peut  simuler  une  panne  moteur  en  passant  l'h6lice 
en  drapeau  tout  en  conservant  le  generateur  en  fonct ionnement . 

6.2  -  MOYENS  DE  MESURES 


L ' insta 1 lat ion  d'essais  realisee  a  et&  la  suivante  : 

6.2.1  -  Mesures  sur  1 ' avion 
-  Enregistrees  sur  HB  A  1322  ( PV  6  mm/s  :  GV  3 Omm/s). 


Parametres 
enregistres  sur  HB 

1  Comment 

i 

i 

!  Objectif 

et  pr 

i - 

1  Circuit  Co-Pilote 

1 

1  Mesure  de  Vc 

Vitesses  de  roues 

1  Une  generatrice  tachym£tr ique 
1  sur  chaque  roue  principale 

i 

1 Mesure  de  Vsol  et 
Idatation  du  moment 
Ide  deco 11 age  LOF 

Compte  tours  de 
roue 

1  Detecteur  de  proximite 

1  et  lance  top  sur  chaque  roue 

1  principale 

1 

1 

iDeterminer  la 
Idistance  de  roule- 
1  ment  par  mesure 
linterne  (integra- 
Ition  des  tops) 

Jx 

1  Accel&rom^tre  sur  plancher 

1 

iDater  la  panne 

1  moteur 

Boitier  X  2018 

1 

I  VHP 2  circuit  Copilote 

1 

1  Synchronisation 
i  des 

1 cinfeth&odolites 

Tops  photos  Camera 

1 

1 

1 

1  Synchronisation 

-  Photo  Panneau  pour  les  parametres  moteurs. 

6.2.2  -  Moyens  sol 

Tra jectographie  : 

-  Par  un  cinetheodol ite,  pour  etalonner  les  generatrices  tachymet r iques  et  sur 
altiports  pour  avoir  la  trajectoire  de  decollage. 

-  Rep&res  sol  sur  la  piste  et  observations  visuelles  de  la  distance  de  roulement 
sur  altiports. 

Une  station  meteo  en  piste  :  Pour  mesurer  le  vent,  la  pression  et  la  temperature, 
Une  ecoute  radio  :  Sur  altiport  pour  assurer  la  securite  et  transmettre  les 
observations  visuelles. 

7)  RESULTATS  GENERAUX 

7.1  -  Simulation  de  la  pente  au  deuxieme  segment 
Nous  voulions  effectuer  ties  essais  en  jouant  le  jeu  operationnel  aux  diff&rentes 
pentes  potentielles  W/v  (ou  limites  poids-pente)  suivantes 

W/v  =  3,5  %  Valeur  representative  de  la  pente  au  2e  segment  u*  moteur  en  panne 
d ' un  DHC6-300  pour  les  exploitations  vis6es 
w/v  =2  %  Valeur  representative  de  la  pente  minimum  reg 1 ementa i re  dans  les 

memes  conditions 

W/V  =  0  Valeur  representative  d'un  avion  limits  poids-pente  au  ler  segment 

par  la  r&g 1 ement at  ion  actuellc  *•  et  interessante  ^  analyser  sur  altiports. 
Pour  des  raisons  de  s£curit6  il  etait  ie  plus  n£cessaire  pour  les  altiports  de  simuler 
cette  pente  potent ielle  avec  une  puissance  symetrigue.  La  methode  suivante  bas&e  sur 
l'affichage  a  priori  du  couple  =  f(m « j ,  W/V)  a  donn£  satisfaction  et  peut  etre  p rSeonia&e 
pour  1 ' ent ra inement  et  les  decollages  k  puissance  d£tar£e. 


W/V  =  TN 
mg 


1 


-  1/f  ne  depend  prat iquement  que  de  la  configuration  et  des  kVs  de  vol  qui  etaient 
tou jours  les  inernes. 

I  P  =  puissance  moteur 

-  TN  traction  nette  =  ^  P  =  ^  X  12,88  X  Torque  X  Np  !  =  rendement  helice 

V  V 

La  figure  6  montre  que  le  rendement  de  1* helice  ne  depend  pas  de  la  puissance  aux 
vitesses  de  decollage.  En  monomoteur  reelle  Np  est  constant  et  egal  a  96  %  au  decollage, 
(des  40  Kt  environ).  On  peut  done  sirnuler  le  W/V  a  iso  Torque  le  Torque  etant  affiche  a 
iso  vitesse. 

La  figure  8  confirme  que  la  performance  pent  etre  determinee  a  partir  de  la  seule 
conn.ussance  du  torque.  Sur  cette  planche  en  effet  toutes  les  conditions  ( Zp,  Ts ) 
situees  sur  une  horizon  tale  conduiservt  a  afficher  le  raeme  torque  a  7  3  Kt. 

L'axe  des  ordonnees  pent  done  etre  gradue  en  Torque. 

La  figure  7  etablie  a  partir  des  donnees  precedentes,  confirme  qu ' a  un  W/v  vise 
corespond  une  valeur  de  Torque/mg  pratiquement  independante  de  la  masse. 

Ce  qui  precede  est  valable  pour  une  simulation  en  monomoteur  (Np  =  96  %) .  Pour  une 
simulation  en  puissance  symetrique  il  faudrait  (?)  afficher  symet r iquement  la  moitie  du 
torque  ainsi  determine.  En  fait,  deux  difficultes  surgissent  :  Le  regime  helice  est 
inferieur  a  96  %  aux  faibles  torques  et  il  faut  sirnuler  la  trainee  dissymet r ique  qui  est 
equiva  1  ent.e  a  vine  baisse  vie  traction  de  10  %.  Le  torque  a  afficher  symetr iquement  sur 
les  deux  moteurs  est  done  :  Torque(2)=  l/2x  0,9  Torque(l)x  96  %  /  N2 

L*  analyse  vie  l' evolution  du  regime  helice  au  decollage  en  fonction  de  -la  vitesse  et  du 
torque  (of  figure  9)  permet  vie  tracer  sur  la  f igure  1 1  les  torques  a  afficher  en 
puissance  symetrique. 

Le  ealoul  a  posteriori  des  W/V  reels  a  inontre  que  cette  methode  donnait  satisfaction. 

7.2  -  Calcul  des  performances  de  roulement 
L 1  equation  du  roul ement  au  sol  est  : 


TN  -  ^  -  (CD  -  ^ CL)  qS  -7T 


TN  =  Traction  nette  -  €  (V,  Torque,  Np,  6"  ) 

M  =  coeff icier, t  de  roulement  (0,025  sur  piste  en  dure) 
tt  =  pente  de  la  piste  :  model isee  f(L)  pour  chaque  piste 
S  =  denslte  de  I'air  f  (Ts,  Ps) 

^  -  1/2  £  V*  (pression  dynamique) 

V  =  f  (  >5p,  <T  ) 

Vsol  +  vent 

CD/CL  =  coefficients  vie  trainee/portance  a  valider 
Les  conditions  <i'essais  (qui  sont  les  variables  opera tionnel  1  es  m,  H,  vent,  profil  de 
piste,  point  de  lacher  vies  freins,6"  )  sont  introduites  en  donnees.  Les  resultats  du 
calcul  L  -  f  (Vsol)  sont  alors  compares  aux  resultats  d'essais.  Les  bases  peuvent  etre 
movlifiees  pour  minimiser  les  ecarts  et,  I'objectif  final  qui  est  de  valider  le  module 
theorique  peut  alors  etre  atteint  rapidement. 

Cette  technique  est  la  plus  efficace  des  lors  qu’on  a  un  minimum  de  donnees  du 

Const ructeur .  Elle  a  ete  retenue  pour  le  DHC6-300,  suite  aux  contacts  fructueux  entre  la 

DGAC  et  DHC  et  le  modele  a  ete  programme  sur  l'ordinateur  IRIS  80  de  la  DGAC . 

Povrr  valider  au  mieux  les  bases  vie  calcul,  il  etait  important  d*  avoir  la  meilleure 
approximation  possible  de  la  traction  nette. 

q  p 

TM  =  ' 


-  avec  ^  rendement  de  1' helice  obtenue  par  la  "Propeller  thrust  chart"  du  constructeur . 

(cf  figure  6).  On  a  admis  que  le  rendement  d' helice  etait  le  meme  aux  regimes  helices 
pratiques  (entre  1900  et  2112  tours/mn). 

-  P  =  12,88  X  Torque  X  Np  (cf  figure  9  et  10  pour  les  valeurs  de  Np  en  fonction  du  torque) 


A  partir  du  reseau  de  donnees  precedent  etabli  pour  chaque  moteur  en  essai  on  obtient 
done  la  traction  nette  a  partir  des  donnees  enregistrees  (Torque,  vitesse,  &  ) 

La  mise  au  point  du  module  de  calcul  a  ainsi  pu  etre  faite  assez  facil ement  en  conparant 
les  distances  essais-calcul  a  iso  Vsol.  Ce  module  simple  rend  bien  compte  des  performances 
de  rou l ement  du  DMC6-300  et  non  des  performances  de  decollage  en  effet  de  sol 


7 . 3-  VMCA_ 

On  a  confirme  la  valeur  publi6e  de  66  kt  avec  volets  10°.  On  a  recherch6,  en  statique, 
la  VMCa  avec  volets  20°  ;  elle  est  leg&rement  inf&rieure,  environ  65  kt  ,  ce  qui  correspond 
comme  verifie  ul t&r ieurement ,  au  chiffre  annonc£  par  le  Constructeur  pour  cette 
con  f igu  ra  t ion . 

La  VMCa  ailes  horizontales  se  situe  vers  73  kt . 

On  a  done  : 

VMCA  (9=5°)  Volets  10° 

Volets  20° 

VMCA  (  <f>  =  0°  ) 


66  kt  en  Vc 
65  kt  en  Vc 
7  3  kt  en  Vc 


En  respectant  la  r^gleraentation  associ^e  a  VMCA  les  vitesses  minimales  au  decollage  sont 
les  suivantes  : 


i - 

I  RAgl ementat ion 

I 

1 

1 

Volets 

10“ 

i 

l 

Volets  20“ 

VLOF 

min 

i 

!  * 
i 

1 , 1  VMCA 

1 

1 

1 

1 

73  kt 

CAS 

1 

l 

l 

l 

5 

71  kt  CAS 

V2  min 

i 

!  » 

1 

1 ,  1  VMCA 

1 

1 

1 

l 

l 

l 

t 

7.4  -  Performances  de  roulement  volets  20° 


La  question  ayant  Ate  soulevee  de  savoir  s*il  etait  interessant,  pour  diminuer  la 
distance  lacher  des  freins  -  LOF,  de  decoller  avec  les  volets  a  20°,  nous  avons  effectue 
sur  piste  plate  et  sur  altiports  quelques  mesures  dans  cette  configuration. 


L* influence  des  volets  sur  la  performance  de  roulement  depend  de  la  pente  de  la  piste 
et  de  la  motorisat ion. 

A  iso  Vsol  on  trouve  : 

-  sur  piste  plate  =  une  augmentation  de  la  longueur  de  20  %  en  bi-moteurs. 

une  augmentation  de  la  longueur  de  50  %  en  monomoteur , 

-  sur  altiports  =  une  augmentation  de  la  longueur  de  10  %  quelque  soit  la  motor i sat  ion 


Si  la  VLOF  avait  lieu  a  iso  incidence  (A  1,1  Vs  par  exemple  de  chaque  conf igurat ion } 
on  aurait,  en  prenant  la  conf igurat ion  volets  20°  au  decollage,  un  gain,  du  a  une  VLOF 
plus  faible,  de  15  %.  Dans  cette  hypothAse  la  configuration  volets  20°  serait  legerement 
avantageuse  sur  altiports  uniquement. 

En  fait,  les  valeurs  de  VLOF  sont  limitees  par  1,1  VMCA,  ce  qui  donne  les  "gains" 
suivants  sur  altiports. 


m  (lb) 

1 - 

1  VLOF  (kt) 
Volets  10“ 

VLOF  ( kt  ) 

1  Volets  20“ 

1  Gain  du  a 

1  VLOF  plus 

1  faible 

1 

1  Perte  due 

1  a  trainee 
Iplus  grande 

1 - 

i  Lr 

1  Volets  20“ 

1 

'  1 

12  500 

75 

1  5 

!  71 

1 . 

1  -  9  % 

1 

1  +  10  % 

(  1 ,  1  Vs  ) 

1  (1,1  VMCA) 

1 

1 

12000 

73 

1  5 

1  71 

I 

1  -  4  i 

1 

1  +  10  % 

I 

1  Augments 

(1,1  VMCA) 

1 

1 

1  6  » 

1 

On  voit  done  qu'il  n'y  a,  a  priori,  aucun  a vantage  a  prendre  la  configuration  volets 
20°  au  decollage  en  ce  qui  concerne  la  performance  de  roulement. 

Comme  le  controle  au  sol,  en  cas  de  panne  mote  iv,  est  plus  delicat  avec  volets  20°  que 
volets  10°.  Ii  est  recommande  de  ne  pas  autorif.er  cette  configuration  de  decollage  en 
utilisation  normale. 

Nota  :  Pour  une  utilisation  speciale  ou  il  serait  justifie  de  faire  1'  impasse  de  la 

panne  moteur,  1 ' ut i l isat ion  de  la  configuration  Volets  20°,  serait  avantageuse 
sur  altiports  seulement. 


8)  RESULTATS  SUR  PISTES  PLATES 

8.1  -  VMCG  (gouvernes  a&rodynamiques  seules) 

Cette  vitesse  a  Ate  determinee  ie  fagon  classique  e'est  a  dire  en  utilisant  les 
gouvernes  aerodynamiques  seules,  en  affichant.  la  puissance  maximale  et  sans  solliciter 
le  manche  en  secteur  avant.  Plusieurs  essais  ont  ete  ef fectues  par  vent  de  travers  pour 
determiner  1* influence  du  vent.  Les  resultats  sont  donn&s  figure  12. 

Les  quelques  points  effectues  avec  volets  20°  n ' ont  pas  faxt  apparaitre  de  difference 
decelable  sur  les  resultats. 

La  valeur  de  VMCG  par  vent,  mil  est  Aqale  a  56  kt  et  a  AtA  confirmee  sur  piste  mouillAe. 
Le  vent  de  travers  augmente  cote  valeur  le  fagon  sensiblement  Agale  A  la  moitie  de  la 
eomposante  de  vent  travers  ier.  Hormis  cela  le  comj'or tement  avion  a  la  panne  n'est  pas 
mod i f ie . 

Sur  le  plan  operat ionno 1 ,  il  pent  s'averer  utopique  do  rentrer  sys tAma t iquement  dans  un 
abaque  pour  determiner  VI  min  en  fonction  du  vent.  On  pourrait  preconiser  VI  min  =  61 
kt,  qui  couvrirait  les  vents  de  travers  jusqu'a  10  kt,  et  alerter  1 'equipage  {•our  lui 
faire  recalculer  sa  VI  min  lorsque  le  vent  de  travers  est  supArieur  A  10  kt. 


8.2  -  Choix  de  VR/VLOF 

L’ object  if  des  essais  eta  it  de  valider  Vlofinin  =  1,1  Vs  avec  ane  vitesse  de  decision 
netteraent  infer ieure. 

Cette  procedure  change  assez  sensiblement  ie  decollage  monomoteur  sur  piste  plate. 

Dans  le  cas  de  la  procedure  reglementai re,  la  panne  a  lieu  a  la  rotation  et  eomme  la 
traction  ne  chute  pas  instantanement  on  accelere  assez  vite  vers  V2 . 

Au  contraire  avec  cette  nouvelle  procedure,  a  VR  on  est  en  monomoteur  etabl i , 

1 'acceleration  est  beaueoup  plus  lente  et  depend  du  Tn/mg ,  et  1 ' on  pent  rester  un  long 
moment,  pres  du  sol  guasiment  en  palier  avant  d'atteindre  V2  lors  les  decollages  s  ir 
pistes  plates. 

Dans  les  conditions  de  l'essai,  a  savoir  turbulence  faible  et  bonnes  references  ext.  e- 
rieures,  la  procedure  est  aisement  praticable  mei.Te  au  Tn/mg  mini  avec  les  reserves  ci- 
apres  : 

1)  Le  controle  tres  fin  de  I'assiette  et  le  palier  apres  VLOF  pourra  etre  penible  a 
executer  sans  bonnes  references  exterieures,  par  exemple  de  unit.  ou  au-dessus  le  la  mer, 
car  la  "negoc iat ion "  du  compromis  var  io-acce  1  era  t  ion  peut  s'y  averer  difficile  a  piiot-»r 
au  T/mg  mini. 

Operat  ionnel  lement  on  pourra  ]Ouer  sur  les  deux  limitations  suivantes  pour  garde  r  .me 
procedure  sure  : 

-  Imposer  une  visibilite  et  autoriser  1  $  decollages  au  T/mg  minimal  - 

-  Avoir  un  Tung  assurant  un  taux  de  montee  confortable  par  exemple  .me  pente  le  3,5  ? 
au  2eme  segment , lorsque  les  references  exterieures  sent  degra.lees. 

2)  II  est  recommande  pour  ne  pas  etre  trop  absorbe  par  les  problemes  le  control*? 
transversal  gui  sont  plus  crucials  sur  piste  etroite  de  prendre  VLOF  VMCA  uiles 
hor i zonta les .  Dans  le  cas  du  Twin  outer  ce  resultat  est.  atteint  aut oma t  ig uenent  en 
prenant  VLOF  =1,1  VMCA  puis  pie 

1 ,  1  VMCA  (  <p  =  5  °  )  =  VMCA  (  <p  =  0 )  =  7  3  k  t  . 

Les  esrtis  confirment  done  gu 1  i  1  n'est  pas  envisageable  -le  deroger  a  1  1  ex  i  ience  VL2FJ; 

1 . 1  VMCA . 

3)  Le  decollage  par  fort  vent  arriere  a  VLOF  =1,1  Vs  en  monomoteur  etabl  i  est. 
deconseille  a  cause  des  eventual i tes  de  gradient  de  vent  def avorabl  *•■>. 

Compte  tenu  le  la  faible  accel era t ion  en  monomoteur  etabl i,  on  recommande  1’asoO‘ier  a 
VR  les  limitations  chois ies  a  VLOF. 

8.3  -  Distance  <le  decollage  sur  piste  plate  avec  un  not ear  en  panne 

Bien  gue  la  reg lementat  ion  en  vigueur  n'exige  pas  cette  me  sure  les  informations  donnees 
par  DHC  donnent.  une  idee  de  ce  gue  sera  it  cette  distance  avec  la  VI  r  eg  1  emont  a  i  re  pour 
1' exemple  deja  choisi  ( cf  figure  13). 

Bien  gu '  i  l  soit  acceptable  de  decoller  a  une  VLOF  egale  a  1,1  Vs,  il  reste  ad  mis  :ue  la 
vitesse  de  securite  au  decollage  V2  doit  etre  conservee  egale  a  1,2  Vs.  11  f.uira  lone 
accelerer  pr&s  du  sol.  Les  clearways  des  terrains  sur  lesguels  la  procedure  special e 
sera  autorisee  devront  done  avoir  une  longueur  superieure  a  la  distance  r eu  I  ement  a  i  re 
actuel  le  separant  le  decollage  LOF  du  joint  ou  l'avion  atteint  V2  et  50ft  tons  noteurs 
en  f onct ionnement . 

En  vue  d'evnluer  cette  distance  quel ques  t  r  a  jocto  i  res  out  ete  suivios  tux  c  i  r.et  heodo- 
lithes  pour  des  W  compris  entre  3,5  %  et  2  *  la  distance  air  paroour.se  »  ete  comprise 
entre  500m  et.  V  1000  n  .  On  retiendra  done  ce  dernier  ehiffre  *ixor  les  eontraint.  e 

1 iees  au  clearway. 

Les  valeurs  reel  les  (fonction  de  la  petite  au  2eme  segment.)  pev.vont  e*  re  obtenues  u.ipres 
de  DHC.  A  defaut  un  calcul  conserv.it  if  gui  ne  prend  pas  en  oompte  1’effet  du  sol,  pourra 
etre  applique  (cf  figure  14) 

8-4  Dispersion  operat ionnel le 

Nous  n'uvons  pas  joue  le  jeu  ie  la  mesure  de  la  dispersion  operat  ionnel  le  sur  pistes 
plates,  ce  jeu  ne  pouvant  etre  valable  qu'en  conditions  reel les  ( limit e  t'oids-pist e 1 . 

Des  avis  pilot.es,  on  pent,  neanmoins  degager  1‘ordre  de  grandeur  le  la  marge  minimale 
a  preirlre  au  roulement  poar  avoir  encore  la  vue  du  bout  de  piste  et  tolerer  un  del  a  i 
de  react,  ion  d'  une  seconde  a  VR. 

Cette  marge  devrait  etre  d ’ env i ron  50  m  (ou  encore  en  etant  plus  conservatif,  proche 
de  10  %  rle  L  piste). 

II  est  evident  gue  cette  marge  peut  etre  adaptee  sur  chague  terrain  on  function  de  la 
nature  de  "1 'overrun". 

8.5  Conclusions  et  reeommunda t ions  sur  piste  plate 

En  appelant  "procedure  speciule"  toute  procedure  TPP2  ou  VI  seruit.  inferieure  a  1,1  \’s  ou 

1.1  VMCA  nous  recommamlons  la  procedure  suivante. 

Clearway  1000  m 

Volets  decollage  10° 

Vent  arriere  10  Kt 

VI  min  =  01  Kt  si  vent  t  ravers  10  Kt 

=  61  +  W- 1 0  si  vent  t ravers  >  in  Kt 
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Masse  maximale  autorisfee 

Limitations  poids-pente  inchang4es  * 

LASD  (panne  moteur  4  VEF)  ^  L  runway 

LLOF  (panne  moteur  4  VEF)  ^  L  runway-50m 

*Si  la  visibility  est  d4grad4e  it  est  recommand4  de  prendre  une  limite  poids-pente 
monomoteur  =  3,5  %  au  2eme  segment. 

Procedure  VI  determine  par  la  relation  pr4c4dente 

VRmin  =  1,1  Vs  ou  1,1  VMCA 
V2  =  1,1  Vs  ou  1,2  VMCA 
Equipage  Un  pilote  qualifi4 


9)  RESULTATS  SUR  ALTIPORTS 


9.1  -  VMCG  en  utilisant  la  diregeabilitfe 

On  a  v4rifi4  qu'en  cas  de  panne  moteur  la  dirigeabilit4  permettait  de  conserver 
1 ‘ axe  avec  un  faible  4cart  initial  (3m).  Le  r4sultat  a  4t4  v4rifi&  en  monomoteur  r4el, 
jusqu’4  des  vitesses  de  panne  de  25kt  avec  vent  de  travers  ( — lOkt)  sur  piste  plate 
I4g4rement  mouill4e  et  en  monomoteur  simul4  4  une  vitesse  de  panne  d* environ  30  kt  sur 
les  altiports. 

Au  sol,  le  contrdle  transversal  4  la  panne  moteur  est  assur4  par  la  combinaison  d'un 
braquage  de  la  direction  et  de  la  dir igeabilit4  qui  vient  en  compl4ment,  afin  de 
conserver  l'axe  4  une  vitesse  inf4rieure  a  VMCg  a4rodynamique . 

Une  certaine  coordination  4quipage  est  n4cessaire,  en  particulier  dans  la  zdne  des  50/60 
kt  oO  la  profondeur  doit  etre  maintenue  secteur  avant,  afin  d’ assurer  une  bonne  adh4rence 
de  la  roulette  de  nez. 

De  plus,  la  dirigeabilit4  ne  doit  pas  4tre  trop  braqu4e,  4vitant  ainsi  de  faire  d4raper 
le  pneu . 

A  1' envoi  il  est  n4cessaire,  compte  tenu  de  la  proximit4  de  VMCa,  de  braquer  la  direction 
proche  de  la  but4e,  voire  d'incliner  I4g4rement  1* avion  pour  assurer  le  contr&le  de  cap. 

La  proc4dure  propos4e  qui  n4cessite  un  4quipage  a  deux  pilotes  est  acceptable  sous  la 
forme  suivante  : 

-  le  pilote  place  gauche  met  les  gaz  sur  freins  et  tient  la  dirigeabilit4  de  la  main  gauche 

-  le  copilote  maintient  le  manche  secteur  avant,  ce  qui  a  pour  cons4quence  de  maintenir 
la  roue  avant  en  contact  avec  le  sol,  gauchissement  au  neutre,  et  annonce  les  vitesses 
4  partir  de  30  kt  (minimum  lisible),  de  10  kt  en  10  kt  jusqu‘4  VR. 

-  4  VR  le  pilote  lache  la  dirigeabilit4,  prend  le  volant  en  main,  et  d4colle  (rappelons 
que  la  manette  de  dirigeabilit4  est  situ4e  environ  4  10  cm  du  volant,  sur  la  colonne  du 
manche,  et  que  le  passage  de  l'une  4  l'autre  est  facile). 

Le  pilote  n'ayant  done  le  controle  du  gauchissement  qu'apr4s  VR,  cette  proc4dure  limite 
la  composante  travers  de  vent  admissible  4  une  valeur  faible  inf4rieure  4  10  Kt. 

Enfin,  les  pilotes  qualifi4s  Altiport  devront  subir  un  entrainement  (sur  piste  horizontale) 
avec  panne  par  r4duction  et  drapeau. 

9 . 2  -  Choix  de  VR/VLOF 

Sur  altiports,  il  n'y  a  aucun  probl4me  4  d4colier  4  VLOF  =  1,1  Vs  compte  tenu  de 
1 ' acc4l4ration  nettement  plus  4lev4e  de  1' avion.  Il  est  m6me  possible  de  prendre  VR 
inf4rieur  4  VLOF  pour  tenir  compte  de  cette  acc4l4ration.  Compte  tenu  du  grand  nombre  de 
d4collages  effectu4s  par  plusieurs  pilotes,  les  r4sultats  statistiques  am4nent  4 
recommander  de  prendre  VR  =  VLOF  -  3  kt 

9.3  - JTrajectoires  au  d4collage  :  marge  au  roulement 

Pour  un  d4collage  limite  poids-piste,  il  semble  que  le  pilote  est  sensible  au  temps  le 
s4parant  du  bout  de  piste  et  qu' il  entame  naturellement  la  rotation  environ  1  seconde 
avant  d'atteindre  le  bout  de  piste. 

L'4quipage  souhaite  avoir  acquis  d4j4  une  certaine  hauteur  quand  il  passe  I'extr4mit4 
basse  de  la  surface  bitum4e. 

On  estime  que  cette  hauteur,  pour  etre  acceptable  sans  4moi  excessif,  doit  4tre  d' environ 
lm.  Des  discussions  avec  des  personnes  ayant  l'exp4rience  de  ces  altisurfaces  il  r4sult«, 
qu'en  hiver,  une  cong4re  de  0,  50  4  1  m  pourra  subsister  en  bout  de  piste  apr4s  d4neigement 
e'est  4videmment  au-dessus  de  cet  obstacle  qu' il  faudra  ajouter  la  marge  de  1  m  mentionn4e 
ci  dessus. 

Des  figure  15  et  754  sur  lesquelles  nous  avons  trac4  la  hauteur  au  seuil  en  fonction  de 
la  distance  de  roulement,  tous  W/v  confondus,  on  peut  d4duire  la  marge  au  roulement  4 
prendre  en  compte  pour  passer  cet  "obstacle''  au  seuil. 


Il 


Marge 

Hauteur  au 
seuil 

(m) 

— 

Marge  de  roulement 
<m) 

Marge  de  roulement 
%  de  Piste 

MEGEVE 

COURCHEVEL 

MEGEVE 

0,5 

26 

35 

6.5 

9.5 

1 

46 

35 

mm 

9.5 

1,5 

50 

40 

12,5 

11 

2 

63 

60 

15 

16 

Pour  le  DHC6  on  a  done  sensibleraent  les  Equivalences  suivantes 
Marge  au  seuil  lm  si  10  %  de  marge  au  roulement 

Marge  au  seuil  2m  si  15  %  de  marge  au  roulement 

Le  calcul  de  la  masse  maximale  au  dEcollage  en  tenant  compte  de  ces  marges  doit  permettre 
d'Eviter  une  rotation  prematurEe. 

9.4  -  Trajectoires  au  dEcollage  -  recherche  d'un  critEre  de  performance 

Une  fois  passE  le  seuil  de  piste  il  est  important  de  continuer  E  s'intEresser  h  la 

trajectoire  d‘ envoi.  II  est  rapidement  apparu,  compte  tenu  de  1* environnement  dEgagE, 
aux  abords  immEdiats  des  altiports,  que  la  trajectoire  intEressante  allait  jusqu'au 
point  oE  le  taux  de  montEe  s'annulait.  Les  figures  16  et  17  donnent  les  trajectoires 
les  plus  bases  constatEes  sur  les  pistes  de  COURCHEVEL  et  MEGEVE  ( ALPE  D'HUEZ  Etant 
un  altiport  Equivalent  a  COURCHEVEL)  Etant  prEcisE  que  les  W/V  pratiquEs  allaient  de 
4,6  %  E  -  1  %). 

On  peut  faire  les  remarques  suivantes  : 

1  -  W/V  voisin  de  2  S  -  Le  pilotage  ne  pose  pas  de  problEme.  L‘ accElEration  de  VR  vers 

V2  est  franche,  car  on  a  naturellement  tendance  E  continuer  E  descendre  lEgErement 
aprEs  dEcollage  ;  on  ne  rEtablit  un  taux  de  montEe  positif  qu'une  fois  V2  Etablie. 

2  -  w/v  voisin  de  0  %  -  L' accElEration  de  VR  E  V2  est  Evidemment  plus  lente  et  la  phase 

la  plus  critique  se  situe  juste  aprEs  le  dEcollage  lorsque  1’ avion  survole  la 
plateforme  prolongeant  la  piste.  Le  pilote  suit  en  gros  la  pente  afin  d'accElErer 
tout  en  conservant  une  certaine  hauteur  de  1  4  2  mEtres  par  rapport  au  terrain. 

V2  atteinte,  il  se  stabilise  en  palier.  Dans  1 ' environnement  trEs  dEgagE  de  l'Alpe 
d'Huez  ou  de  Courchevel  la  manoeuvre  est  acceptable.  Sur  le  plan  rEglementaire 
la  manoeuvre  est  acceptable,  semble-t'il,  E  condition  de  passer  le  seuil  E  une 
certaine  hauteur  (  —  1  m)  et  4  Vi  —  V2. 

3  -  En  prenant  les  marges  au  roulement  recommandEes,  on  constate  que  l'on  obtient  VZ  «=  0 

tou jours  au  dessus  du  seuil. 

4  -  Pour  les  w/v  nEgatifs  le  pilote  tend  4  Etablir  instinctivement  une  trajectoire 

montante.  Le  taux  de  descente  s'annule  mais  forcement  au  dEtriment  de  la  tenue  de  la 
vitesse  qui  diminue.  Ceci  est  dangereux  et  done  inacceptable  en  monomoteur  rEel. 

Compte  tenu  de  ces  remarques  il  semble  acceptable  de  conserver  la  limitation  poids-pente 
au  ler  segment  donnant  un  W/v  *  0  .  Pour  Eviter  aux  autoritEs  des  altiports  concernEs  a 
avoir  4  controler  les  obstacles  sur  une  trajectoire  descendante  on  peut  suggErer  que  la 
trajectoire  nette  soit  au  dessus  de  celle  prEsentEe  figure  18.  Cette  trajectoire  nette  se 
termine  par  une  pente  E  0  %  -  qui  imposerait,  selon  les  errements  en  vigueur  pour  les 
bimoteurs  une  pente  brute  de  0,8  S  au  deuxiEme  segment.  L'expErimentation  effectuEe 
confirme  que  ce  w/v  de  0,8  *  reste  acceptable  dans  1 ' environnement  des  altiports  pratiquEs 


9.5  -  Conclusions  et  recommandations 


Limitations  Volets  dEcollage 
Vent  arriEre 
Vent  travers 

Masse  maximale  au  dEcollage 

Limitations  poids-pente 


Llof  (panne  moteur  E  VEF) 


ProcEdure 


10* 

<  10  Kt 

<  10  Kt 

inchangEe  au  ler  segment 
0,8  %  au  2eme  segment 
<  0,9  Lrunway  I  selon  dEneigement 
0,85  Lrunway  I  du  seuil  de  piste 


DEcision  au  point  de  cassure  de  pente 
VR  -  1,1  VS  (ou  1,1  VMCA)  -  3Kt 
V2  -  1,2  Vs  ou  1,1  VMCA 

Tenir  l'axe  avec  la  dirigeabilitE  profondeur  maintenue  E  piquer. 
Equipage  2  pilotes  qualifiEs 
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9.6  -  Type  d'altiport  recommandfe 

Au  cours  de  ces  essais  effectu4s  sur  lea  3  altiporta  de  Hegive,  Courchevel,  Alpe  d'Huez 
avec  plusieurs  pllotes,  il  est  apparu  clalrement  que  l'altlport  d'Alpe  d ' Huez,  fetait  le 
plus  satisfaisant .  Sa  cassure  est  assez  loin,  ce  qui  perraet  des  vitesees  de  decision  plus 
6lev6es  et  il  n'est  pas,  contrairement  4  Megive  et  Courchevel,  limit4  Poida  -  piste,  ce 
qui  permettrait  une  exploitation  plus  rentable. 

Avec  une  zone  lat&rale  de  d6gagement  en  cas  d ' acceleration  arret,  ce  type  d'altiport  serait 
proche  de  1‘ optimum. 


10  )  ATTERRISSAGE  SUR  ALTIPORTS 

Nous  avons  profite  de  cette  experimentation  pour  effectuer  egalement  des  mesures  A 
l'atterrissage.  Compte  tenu  de  1 1 echantillon  de  pilotes  ayant  participe,  les  resultats 
statistiques  obtenus  peuvent  etre  estimes  representatif s  d'une  population  de  pilotes 
qualifies  sur  la  machine  et  qualifies  montagne.  A  Meg4ve  et  4  Courchevel,  les  approches 
ont  et6  effectu6es  alternativement  avec  et  sans  VASI.  Les  trajectoires  ont  6t6  filmes  au 
cin6th6odo lithe  (A  l’Alpe  d'Huez,  il  n'y  a  pas  de  VASI  et  il  n'y  avait  pas  le 
cinetheodo lithe) .  La  procedure  etait  tou jours  la  meme  s  Approche  A 
VREF  =  67  kt  avec  les  volets  &  37*5. 

10.1  -  Precision  d' impact 


— 

Distance 

— 

MEGEVE 

— 

COURCHEVEL 

Seuil  -  Impact 

(metres) 

Sans 

Avec 

BSH 

1  I 

VASI 

VASI 

Moyenne  (mi) 

92 

64 

104 

114 

Ecart  Type  S  i 

20 

20 

45 

21 

mi  +  2  6  i 

EMM 

14  -  194 

72  -  156 

Ces  resultats  montrent  que  l'atterrissage  sans  VASI  est  plus  deiicat  A  COURCHEVEL 
(plus  disperse).  Un  critere  possible  en  approche  manuelle  est  de  prendre  m  +  2«J comme 
dispersion  maximale  en  utilisation  normale.  Avec  ce  crit&re  on  voit  qu’il  reste  encore  de 
la  marge  par  rapport  A  la  piste,  mais  c'est  juste  4  COURCHEVEL  sans  VASI.  Ce  critire  qui 
est  assez  facile  d' application  (observateurs  visuels)  pourrait  etre  retenu  pour  d'autres 
avions  postulants  A  une  utilisation  TPP  sur  altiports. 

10.2  -  Distance  de  roulement  A  l'atterrissage 

Il  est  assez  irrealiste  sur  un  altiport  de  mesurer  la  performance  d' atterrissage  comme 
etant  cells  obtenue  en  freinant  au  maximum.  Un  atterrissage  normal  se  fait  sans  freiner, 
sauf  sur  la  plateforme  pour  manoeuvrer,  et  il  faut  souvent  remettre  des  gaz  pour  rouler 
et  remonter  la  pente  jusqu‘4  la  plateforme. 

Nous  avons  done  dtfini  une  distance  de  roulement  comme  6tant  la  distance  s6parant  1' impact 
du  point  oik  l'avion  est  contr&lfc  (environ  4  30  kt),  l'fcquipage  effectuant  lee  actions 
habituelles  4  l'atterrissage  sur  altiporta  notamment  en  passant  les  manettes  de  puissance 
sur  ralenti  reverse,  sane  jamais  freiner  ni  appliquer  la  puissance  en  reverse  (sauf 
ntcesitt,  qui  ne  s' est  pas  produite). 

Les  r4sultats  sont  les  suivants  i 


— 

L  roulement 
(m) 

— 

MEGEVE 

COURCHEVEL 

ALPE  D'HUEZ 

Moyenne  mr 

197 

139 

162 

Ecart  type  r 

30 

18 

19 
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10.3  -  Longueur  de  piste  nAcessaire 

A  notre  avis,  il  n'est  pas  utile  de  prendre  en  compte  le  fr  du  rouleraent  dans  l'analyse 
de  la  longueur  de  piste  nAcessaire  A  1 ' atterrissage.  En  effet,  le  pilote  pourrait  jouer 
sur  a~  en  mettant  plus  ou  moins  de  reverse  ou  de  freins  ■  il  y  a  correlation  Avidente 
entre  la  distance  de  roulement  et  le  point  d* impact.  Il  est  par  contre  important  de  vferi- 
fier  que  la  valeur  moyenne  du  roulement  telle  que  nous  l’evo^s  dAfinie  et  mesurAe  permet 
d'arriver  tranquillement  (30  kt)  au  maximum)  sur  la  platefor  e. 

La  valeur  de  reference  serait  alors  : 
mi  +  2  <T  i  +  mr 

ce  qui  donne  a  MegAve  sans  VASI  319  m  (pour  403  m  total) 

k  Courchevel  sans  VASI  333  m  (pour  370  m  total) 

10.4  -  Conclusion  sur  les  atterrissaaes 

Le  DHC6  Atant  un  avion  trAs  satisfaisant  k  1 ‘ atterrissage  sur  altiports,  il  ne  faut  pas 
perdre  de  vue  que  des  avions  moins  "per formants"  pourraient  encore  Atre  acceptables.  Les 
critAres  proposes  ci-dessus,  ne  le  sont  qu'A  titre  indicatif  mais  rendent  compte  neanmoins 
du  fait  qu'une  marge  suppl Amentaire  reste  encore  disponible. 

Nous  ne  saurions  trop  insister  sur  1 ' importance  du  VASI  qui  a  pour  principal  intAret  de 
permettre  de  stabiliser  la  pente  d'approche  et  d'Aviter  les  erreurs  d' appreciation  que  la 
repartition  J  m  +  2  proposee  ci-dessus  ne  prend  pas  en  compte.  Il  serait  d4raisonnable 
d'envisager  une  utilisation  commerciale  sans  VASI  (en  particulier  par  conditions  MAtAo 
moins  favorables  que  celles  volontairement  recherch4es  pour  cette  experimentation). 


11)  EXPLOITATIONS 


Les  autorisations  d‘ exploitation  ont  At£  donnees  cas  par  caa  sur  les  bases  de  recommen¬ 
dations  prAcAdentes  -  en  utilisant  le  modAle  de  caicul  valide  par  les  essais  et  done 
applicable  pour  le  moment  au  seul  DHC6-300  (cf  figure  19).  Elies  ne  sont  valables  que 
sur  des  pistes  seches  en  dur.  Le  problAme  de  la  marge  du  roulement  a  AtA  r4solu  de  fagon 
conservative  en  considArant  que  la  piste  disponible  utilis£e  pour  les  calculs  au 
d£collage  =  0,  85  L  runway. 

Cette  marge  de  15  %  est  >  aux  recommandations  pr£c£dentes.  Pour  l'exemple  choisi 

ra  =  5670  Kg  Ts  =  25*  Z  =  0  .  On  trouve  LASD  =  Llof  =  510  m  avec  VI  *  64,  3  Kt  (piste 

balanc£e).  Lrunway  exig£  =  1,15  x  510  =  586  m 

Nous  avons  surtout  parle  de  d£collage.  Hors  ii  faut  bien  Agalement  atterrir  I 
L'arrSte  du  25  Novembre  1974  prAcise  que  sur  les  terrains  pr£sentant  un  d£gagement 
suffisant  la  distance  d ' atterrissage  doit  etre  infArieure  ou  Agale  4  70  %  de  la  longueur 

utile  k  1 ' atterrissage  (Lrunway).  La  figure  20  montre  que  cette  exigence  est  compatible 

avec  les  limitations  au  d£collage  ce  que  rer.  1  des  pistes  de  600  m  exploitables  par  un 
DHC6-300. 

Il  faut  insister  sur  le  fait  que  pour  le  moment  ces  autorisations  d' exploitations  sont 
donn£es  cas  par  cas  apr£s  examen  par  les  autorit£s  opArationnel les  de  la  DGAC  des 
particularit£s  propres  k  chaque  terrain  et  k  chaque  compagnie  concernAs. 

L'examen  des  probl£mes  qu'aurait  pu  pose  ces  procedures  est  pr£vu  aprAs  une  pAriode 
d ' exploitation  de  6  4  12  mois  e'est  A  dire  dans  les  mois  qui  viennent.  Une  reduction  de 
la  marge  de  15  %  A  10  %  sera  alors  examinee. 

12)  CONCLUSION 

Les  etudes  menees  par  la  DGAC  avec  l'aide  de  DHC  et  des  utilisateurs  ont  permis  de 

definir  des  procedures  qui  garantissent  k  priori  un  niveau  de  sAcuritA  satisfaisant 

en  ce  qui  concerne  la  panne  de  moteur  au  d£collage  sur  des  pistes  courts*  utilisees 

par  des  avions  multimoteur  de  TPP2  (masse  inf£rieure  A  5700  Kg  amenag4s  pour  10  pax  et  plus) 

Les  autorisations  d* exploitation  sur  ces  pistes  selon  ces  procedures  £tant  trAs  rAcentes 

il  est  prAmaturA  de  tirer  des  conclusions  definitives  sur  les  r£sultats  opArationnela 

Les  derogations  accordAes  ne  concernent  pour  le  moment  que  1' avion  DHC6-300. 

Les  recommendations  formulAes  seraient  cependant  applicables  A  d'autres  types  d* avions 
k  condition  de  disposer  des  donn£ea  compl Amenta ires  concernant  la  vitesse  minimale 
de  contrdle  au  sol  et  les  performances  de  roulement  au  dAcollage  avec  un  moteur  en  panne. 


REFERENCES 


1  -  J.M  DUC 


2  -  M.  COLLOT 


3  -  J.P  MUGNIER 


4  -  B.  FOUQUES 


Compte-rendu  de  la  oarapagne  devaluation  du  BREGUET  941S 
sur  altiports 
CEV/la/SE/AV  n*  9  :  1972 


Experimentation  atterriasage  de  nuit  but  altiports 
SE/AV  n‘  28  s  1972 


Proposition  d' adaptation  A  la  r4glementation  actuelle 
JPM/MFC/SFACT  :  9.11.1977 


Easais  vent  de  travers  sur  DHC6 
CEV/Xa/SE/AV  1772  :  1980 


t+eeevE  (4800/t) 


L  lof  ^  L  runway 
L  SO  ft  ^  l  runway  +  clearway 


L  lof  +  marge  ^  L  runway 
L  SO  ft  L  runway  +  clearway 


EF 


Acceleration 


* 

1  1  Stop 


LASD  ^  L  runway  +  stopway 

Vl/VLGF  >  1,1  VMCA/1,1  1/S  [ 
V2  >1,1  VMCA/1,2  VS  I 


Fig  2  -  Rfeglement  Applicable 


EF 


Acceleration  I  Stop 


LASD  ^  L  runway 


vEr 

VMCG 

VL  OF 

1,1  l/MCA/1,1 

VS 

M2 

1,1  VMCA/1,2 

VS 

Fig.  3  -  Derogation  possible 


1  if  decision  i 
■  here  ’ 


■  1 


Acceleration 


VLOf  ^1,1  VMCA/1,1  US 


Fig.  4  -  Cas  particulier  Altiport 


Fig.  S  -  Derogation  possible  Altiport 


)1NN 


0  H  f  6  -  <1)0  CORHF  SPOWWer  FORQUf  1  HOIfUR  ?  a  TORQUC  ?  NOTtURS  a  73  kt 


i  rfp  -  c*tc 


rt*<L  96%  si  ****<  &>pst 


D  H  C  6  -  3  0  0 

VITE5SF  MINIMALE  DC  CONTROLE  SOI  (Couvernes  ae rodynamlques 
seules)  Volets  10°  -  Volets  20® 

WWT US  rrtivrif j  Puissance  au  lacher  des  frelns  N  -  96%  Torque  -  48, S  psl 

msaAe  ’  A  Som  , 


*  / 


♦  / 

/ 

/♦  4  0>W4«# 

/  4  A'FWHIfff 


/  yp  9f 


V(rz 


«■/** 


l^tof  r  Wkt 

1 

Acc61#ratijpij^^^ 

AEO 


>  612  01 


_  _  *  _  _  i 


I  I 


LASD  =  786  m  5* 


1177  oi  ^ 


Vior*  -*."**4  -U* 

_ ^  Acc<*  1  Oration  OF  I 

*  W/l  =  2  ni  seqment  climb  gradient 

i 

i  Required  clearway 

*  - ; - 

f  in.  14  -  flearway  anprnx ima L ion 


Fig.  13  -  Take  off  distance  OEI 

i.iti 


10-1 


CARACTERISATION  SYSTEMATIQUE  DES  EFFETS  DE  L ' ELECTRICITE  ATMOSPHERIQUE 
SUR  LES  CONDITIONS  OPERATIONNELLES  DES  AERONEFS 


par  Joseph  Talllet 

Directeur  du  Diparteaent  de  Physique  GEnErale 

Office  National  d'Etudes  et  de  Recherches  AE ros pat  tales  (ONERA) 

B.P.  72 

92322  Ch A 1 11 Ion  -  France 


RESUME 

L ' In t roduc t Ion  des  commandes  de  vol  Electrlque  et  la  generalisation  des 
structurels  en  composite  ont  rendu  nEcessalre  une  Evaluation  precise  de  la 
1 ' E lec t r lc ItE  atmosphErique  sur  les  conditions  opE r at lonne 1 lea  des  aeronefs- 
tErlsatlon  systEmatlque  de  cette  menace  exlge  la  rEallsation  d'essals  en  vol 
des  avlons  a  1 1  ins t rume n t a t Ion  part lcul  ISrement  Elaboree.  Les  rEsultats  obtenus  ne  peu- 
vent  Stre  exploltEs  avec  profit  que  grAce  a  une  confrontation  permanente  des  Equlpes  A 

l'Echelle  Internationale  organlsEe  par  le  blais  de  Conferences  spEc  ial  lsEes ,  ou,  mleux, 

d'accords  bllatEraux  comportant  des  Echanges  de  donnEes  et  de  personnel. 

ABSTRACT 

The  Introduction  of  fly-by-wlre  and  Active  Control  Technology  and  the  extensive 
use  of  composite  materials  have  emphasized  the  need  for  a  precise  assessment  of  atmo¬ 
spheric  electricity  Impact  on  aircraft  operation,  or,  In  other  words,  of  the  threat  due 
to  static  charging  and  lightning  on  the  avionic  systems.  To  characterize  this  threat  In 
a  systematic  way,  flight  tests  have  to  be  performed  using  aircraft  Instrumented  with 
very  sophisticated  measurement  systems.  For  both  static  electricity  and  lightning,  the 
philosophy  of  this  type  of  test  is  discussed,  starting  from  the  physical  mechanisms 

involved,  analyzing  the  nature  of  the  threat,  mentioning  the  hardening  methods  and, 

more  generally,  giving  the  backbone  of  the  research  and  development  effort  needed  to 
solve  the  problem.  The  scope  of  systematic  characterization  by  flight  tests  with  spe¬ 
cially  Instrumented  aircraft  Is  defined,  and  the^  conditions  of  such  operations  are 
given  in  detail.  A  general  conclusion  emerges  from  this  analysis  :  to  Increase  the 
amount  and  the  relevance  of  the  data  from  which  a  world-wide  model  is  extracted,  it  Is 
necessary  to  compare  measurements,  to  criticize  methods  and  to  fit  the  results  Into  an 
f  unique  set  :  this  requires  an  International  cooperation  by  the  channel  of  specialist 

meetings  or  bilateral  agreements  involving  exchange  of  data  and  personnel. 

$ 

I  -  GENERALITES  ' 

l!  Trols  facteurs  ont  attlrE  I1  at  tent  Ion,  dans  la  derniEre  dEcennle,  sur  les  Inter¬ 

actions  Elec  trie  it E  atmosphErlque/aEronef  : 

a)  la  nEcessltE  de  permettre  le  vol  quelles  que  solent  les  conditions  mEtEorolo- 
glques  ; 

b)  la  genE ra 1 lsat Ion  des  matSrlaux  composites  dans  la  structure  ; 

c)  la  mlse  en  oeuvre  des  commandes  de  vol  Electrlques  et,  plus  genEralement ,  le  dEve- 
loppement  des  techniques  de  ContrBle  Automatlque  GEnErallsE  (CAG). 

Ces  facteurs  augmentent  la  vu 1 nS ra b 11 1 1 E  des  aEronefs  aux  effets  de  1  ’ E lec t r lc 1 1 E 
atmosphErique  (ElectrlcltE  statlque  et  foudre). 

Le  8 ou c 1  de  rfidulre  cette  vulnErabll itS  a  suscltE,  depuls  une  dlzalne  d'annEes,  un 
Important  effort  de  recherche  et  de  dEveloppement.  Dans  le  cadre  de  cet  effort,  11  est 
nEcessalre  de  caractErlser  de  faqon  systEmatlque  la  menace  que  constltue  1 ' E lec t r  lc 1 tS 
atmosphErique  pour  le  vol  des  aEronefs.  En  partlculler,  si  l'on  consldEre  le  problEme 
de  la  senslbllltE  de  l'Avlonlque  aux  perturbations  E lec t romagnE t lques ,  11  est  lntEres- 
sant  de  comparer  la  menace  due  A  la  foudre  et  celle  due  I  1 ' E lec trie ItE  statlque.  Cette 
carsctEr lsat Ion  est  Indispensable  b1  l'on  veut  dlmenslonner  correctement ,  aussl  blen  en 
polds  qu'en  coQt,  les  dlsposltlfs  de  protection  chargEs  d'assurer  la  survle  du  systEme 
dans  les  conditions  les  plus  sEvires  que  1'aEronef  est  susceptible  de  rencontrer. 

Four  effectuer  cette  carac tE r isst ion ,  1' ut 11 lsat Ion  d'essals  en  vol  sur  des  appa- 
reils  spEclalement  InstrumentEs  s'est  avErEe  nEcessalre.  Le  but  de  la  prEsente  synthEse 
est  de  dlflnlr  l'objectif  prlcls  et  les  llsltes  de  ce  type  d'essals  en  vol  dans  l'en- 
eemble  du  processus  de  recherche  et  dEveloppement  devant  aboutlr  A  la  dEflnltlon  d'une 
protection  EquilibrEe  des  aEronefs  contre  les  dangers  de  1 ’ E  lec t r  lc  1  tS  statlque,  de  la 
foudre,  et,  Eventue 1 lemen t ,  de  l'lmpulslon  ElectromagnEt  ique. 

II  -  INTERACTION  ELECTRICITE  STATIQUE/AERONEF 

Nous  Etudlerons  d'abord  le  problEme  posE  par  1' accumulat Ion  sur  la  cellule,  dans 
certalnes  conditions  de  vol,  d ' E lec t r lc ItE  statlque.  Pour  cels,  nous  rappellerons 
succ Inclement  les  mEcanlsmes  physiques  responsables  du  phEnomEne,  dEf  Inirons  la  nature 
de  la  menace  pour  lea  aEronefs,  citerons  les  techniques  de  protection  d'usage  courant, 


matErlaux 
menace  de 
La  carac- 
ut  11  lsant 


ainsi  que  la  methodologie  employee  pour  ameliorer  cette  protection  ;  nous  sltuerons 
enf  in,  sur  un  exemple  precis,  l'lnt§r@t  des  methodes  d'essals  en  vol  en  soul  ignant  lee 
resultats  r£cemment  obtenus  au  cours  de  tels  essals. 

II- 1  *  Mfcan  isme8_ghy s lques_d e^cha rge_des_ae rone f a 

Nous  retiendrons  essent  le  1  lenient  deux  m^canlsmes  : 

a)  lorsque  l'a£ronef  rencontre  des  precipitations  solides,  le  contact  des  aerosols  in  i- 
tialement  neutres  avec  la  cellule  leur  confdre  une  charge  Slectrique,  la  charge 
oppos^e  Itant  laiss£e  sur  1'aSronef  ;  c'est  ainsi  que  les  aerosols  de  glace  chargent 
la  cellule  negat  ivement ,  le  courant  correspondent  pouvant  atteindre  plus  leurs  mill!- 
amperes  pour  un  avion  gros  porteur  ;  les  precipitations  llquldes  donnent,  par  suite 
de  1 ' £c  lat eraent  des  gouttes  d’eau  a  la  suite  de  1' Impact,  une  charge  positive  3 
1 ' a£r one f  ; 

b)  lorsque  l'aironef  se  trouve  situ§  au  volsinage  de  nuages  § lec t r  iquement  charges,  11 
se  cree  par  influence  £  1 e c t r o s t a t  iq ue  une  separation  des  charges  1  ibres  &  la  surface 
de  la  cellule  ;  le  champ  electr  ique  superficiel  peut  atteindre,  en  certains  points, 
une  valeur  suffisante  pour  amor^er  une  decharge  corona  ;  en  general,  des  d£charges 
des  deux  s ignes  sont  araorcees,  ma  is  le  syst£me  n'est  pas  suffisamment  symetrlque 
pour  que  les  courants  posltlfs  et  negat  if  s  de  ces  decharges  se  compensent  :  la 
difference  contribue  done  a  charger  llectriquenent  la  cellule. 

Pour  plus  de  details  sur  les  mecanisraes  de  charge  des  a£ronefs,  nous  renvoyons  3 
la  litterature  [1]  [2\  [  3  ]  - 

11. 2  -  Nature_de  la  menace  due_a_l|_£  lectr  ic  ite  statique 

L'£nergie  £ lec t ros tat ique  accumulee  sur  la  cellule  a  une  valeur  tres  falble  et  ne 
serait  absolument  pas  genante  si  elle  ne  se  transformalt  pas  en  energie  £  lec t r omagne- 
t  ique  par  amorqage  de  d£charges  £lectrlques  a  part  ir  d*  une  valeur  critique  du  champ 
electr  ique  produit  par  1  *  a ccumu 1 a t ion  de  ces  charges  statlques.  Cette  Energie  £lectro- 
magn^t  ique  est  rayonnee  sous  forme  de  parasites  rad  ioelect r lques  sur  les  antennes  des 
syt£raes  de  radio-communications  et  de  radio-navigation  de  l'aeronef,  et  peut  gravement 
perturber  le  f one t  ionnemen t  de  ces  syst£raes  critiques  pour  la  s£curite  du  vol. 

L'exposit  ion  3  des  conditions  me teorolog lques  de  nature  S  provoquer  un  courant  de 
charge  §lectr  Ique  peut  etre  de  longue  duree  ;  la  phase  de  roauvals  f one t  ionnemen t  des 
syst£mes  incrimines  survient  toujours  lorsque  ces  systdmes  sera  lent  le  plus  utiles  (vol 
aux  instruments)  :  II  s'agit  done  d’une  menace  relat  Ivement  peu  brutale  ma  is  particu- 
li£rement  insidieuse.  Ce  danger  se  raanifeste  surtout  pour  les  aeronefs  de  petite  dimen¬ 
sion,  avions  civils  d’affaires  ou  de  tourisme,  appareils  rallitaires  d ' e n t r al neme n t , 
helicopteres,  dont  les  antennes  sont  relativement  proches  des  sources  de  parasites. 

Trois  types  de  d&charges  sont  provoquls  par  1 ' accurau lat ion  d'£lectrlcit§  stat Ique 
(fig.  1)  [4]  : 

a)  les  €tlncelles,  entre  conduc  teurs  metall  iques  port£s  3  des  potentlels  £lectriques 
diff£rents  par  suite  d'effets  de  charge  d  if f § ren t  le 1 le  ; 

b)  les  d£charges  gllssantes,  sur  les  surfaces  isolantes  chargees  (fig.  2)  ; 

c)  les  decharges  corona,  au  niveau  des  pointes  et  des  angles  vifs  conducteurs  de  la 
structure. 

Ce9  d£charges  ont  un  courant  impulsif,  done  susceptible  de  rayonner  une  forte 
energie  £ 1  ec t r omagne t iq ue  ;  3  titre  d'exeraple,  la  decharge  corona  negative  se  caract£- 

r  Ue  souvent  par  un  regime  de  relaxation  forme  d’  Impulsions  dltes  de  Trichel,  dont  la 
forme  est  donn§e  sur  la  figure  3  (double  exponent  lei le  de  temps  de  roont€e  10  ns  et  de 
constante  de  temps  de  descente  100  ns)  ;  le  spectre  cor respondant  est  donn£  par  la 
figure  4  ;  on  volt  que  l'£nergie  rayonnee  est  importante  dans  le  domaine  de  fonction- 
neraent  de  la  navigation  Om£ga  (VLF),  du  radlo-compas  (HF)  ;  elle  est  no  ins  importante 
dans  le  domaine  du  VOR  et  de  1* ILS  (VHF)  et  devient  n£gligeable  pour  le  MLS  (UHF  et 
m  ic r o-onde s )  .  C’est  pourquol  les  appareils  de  l'avlatlon  g&n£rale,  les  molns  bien  £qui- 
pes  pour  des  raisons  £conomlques  en  moyens  de  r ad  io- na v  lga t  ion  d  frequence  £lev£e,  sont 
aussl  les  plus  vulnerables  &  la  menace  de  1  *  6 lec t r ic 1 t£  statlque.  En  partlculler,  les 
radio-corapas  sont  paralyses  par  saturation  de  leurs  boucles  de  reaction  sous  l'effet  de 
d&charges  gllssantes  qul  s ' £ t ab 1  is  sen t  par  suite  de  1  * accurau lat ion  de  charges  statlques 
sur  les  carines  d'antenne.  Le  ra£rae  ph£nomdne  peut  provoquer  des  erreurs  de  fonction- 
nement  des  circuits  associes  au  VOR-ILS  de  certains  avions  d'entralneoent  (5)  [6]  [7). 

11. 3  -  I^chniques^de^grotectlon^d^usagecourant 

Dans  l'ensemble,  les  techniques  de  protection  d  appllquer  sont  connues  depuls  de 
nombreuses  annfies  ; 

a)  pour  supprimer  les  £tlncelles,  il  suffit  de  pratlquer  la  metallisation  de  l'appa- 
reil,  e’est-d-dire  teller  £ lec t r  iquement  toutes  les  parties  conductrlces  ; 

b)  pour  supprimer  les  d&charges  de  surface,  il  faut  recouvrir  de  revttements  antistatl- 
ques  les  parties  isolantes  susceptlbles  d'etre  chargees  par  le  contact  des  precipi¬ 
tations  ;  ces  revltenents  sont  des  couches  reslstlves  asses  conductrlces  pour  empl- 
char  1 ’ accuau la t  Ion  des  charges  statlques  oa  is  asses  reslstantes  pour  ne  pas  conprc* 
mettre  la  transparence  r ad  io-e 1 ec t r  ique  des  radftaes  et  carines  d'antenne  ; 
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c)  lea  decharges  corona  ne  peuvent  pas  Stre  supprimees,  car  elles  particlpent  3  l'iqul- 
1  lbre  ilectrlque  de  l'aironef  ;  on  se  contente  done  de  dlmlnuer  leur  couplage  avec 
lea  antennes  ;  pour  cela,  on  lea  ilolgne  de  la  masse  de  la  cellule  en  favorlaant 
leur  amorqage  a  l'extrimiti  de  polntes  mitalllques  fines  relives  3  la  structure  par 
une  resistance  de  valeur  ilevie  (decouplage  reslstlf)  ;  on  peut  ausal  orlenter  la 
1  igne  de  courant  de  ces  decharges  per  pend  Icula lrement  3  la  1  Igne  de  force  du  champ 
electr lque  que  rayonnera It  1' antenne  fonctlonnant  comme  imettrlce  (decouplage  ortho¬ 
gonal)  ;  on  peut  enfln  remplacer  la  polnte  mitalllque  par  l'extrimiti  d'un  falsceau 
de  fibres  de  carbone  ;  on  montre  que,  dans  ces  conditions,  chaque  Impulsion  de 
Trichel  eat  remplacie  par  un  grand  nombre  de  m 1c ro- Imp ul s ions  decorrelees,  ce  qul 
dlmlnue  le  bruit  rad  io-i lec t r lque  3  la  source  ;  les  dlsposltlfs  correspondents  aont 
appeles  diperdlteurs  passlfs  (fig.  5)  [ 4  J  {8). 

L ' ut  11  Isa t  Ion  de  deperd  lteurs  passlfs  peut  se  heurter  3  des  dlfflcultis  partlcu- 
llires  dans  le  cas  des  hilicoptires  en  vol  stat  lonnalre  ;  par  allleurs,  11  peut  itre 
difficile  d'ivlter  lea  decharges  corona  locallsies  3  l'extrimiti  des  pales  d'une 
hillce  :  nous  ne  tralterona  pas  lc  1  compUteoent  le  cas  des  avlons  3  hillce  et  des 
hellcoptires  ;  certalnes  de  nos  conclusions  ne  s'appllquent  en  toute  rlgueur  qu'au  cas 
des  avlons  munis  de  riacteurs. 

II. A  -  Mfthodologle_d^q£tlm!satlgn_de_la_erotectlon_flectro8tatlgue 


La  definition  et  la  mlse  en  oeuvre  des  dispositions  dest  lnees  3  assurer  la  protec¬ 
tion  des  aironefs  contre  les  effets  des  charges  i lec t ros t a t  lques  ne  sont  pas  des 
operations  trlvlales  :  le  succis  depend  de  1  * appl  1  cat  ion  rlgoureuse  d'une  mithodologie 
dont  les  Elements  essentials  ont  iti  formule  par  Nanevlcz  et  al,  et  qul  a  iti 
ricemment  completie  par  les  travaux  de  l'ONERA  [  (9)  [10]. 

La  premlire  itape  de  la  protection  conslste  a  effectuer  une  mi t a 1 1  Isa t Ion  conve- 
nable  ;  pour  orlenter  ce  travail,  11  est  necessalre  de  pouvolr  mesurer  la  resistance 
ilectrlque  entre  parties  metalliques  de  1'aSronef  mime  si  ces  parties  sont  recouvertes 
exti r leurement  de  peinture  Isolante  ;  e'est  le  r81e  d'un  apparelllage  specialise  fonc- 
t  lonnant  par  capaclte  3  travers  la  coache  de  peinture,  le  CORAS.  L1  Intervent  ion  de  cet 
instrument  permet  de  reperer  tris  rapldement  des  defauts  de  metallisation  lndecelables 
par  les  moyens  class lques. 

La  deuxlime  6  tape  conslste  3  recouvrlr  les  parties  lsolantes  suscept  lbles  de  subir 
1'  impact  des  precipitations  par  un  revitement  ant  is tat lque .  L3  encore,  le  CORAS  est 
utilise,  aussl  bien  au  cours  de  1 ' e labors t  Ion  3  l'ateller  des  couches  ant  Is  tat lques  que 
pour  des  verifications  sur  le  terrain  ;  11  permet  en  effet  de  connaltre  la  valeur  de  la 
resistance  de  surface  de  ces  couches,  meme  si  elles  sont  protegees  par  une  couche  iso¬ 
lante  de  peinture  de  flnltlon. 

L'efficaclte  de  ces  mesures  de  protection  contre  les  etlncelles  et  les  decharges 
de  surface  est  ensuite  teatee  au  sol  par  simulation  ;  on  peut  utlllser  pour  cela  un 
lnjecteur  de  charges  i  lec t ros tat lques ,  l'INJECO,  qul  projette  localement,  sous  forme 
d'airosol  de  glace  charge,  un  courant  pouvant  aller  Jusqu'3  100  pA  .  Cette  mithode  loca¬ 
le  est  efficace  pour  diceler  les  anomalies  provenant  d'une  protection  Insufflsante  con¬ 
tre  la  charge  d  1  f f k rent le 1 le  entre  les  diffirentes  parties  de  la  cellule,  qul  const ltue 
la  cause  prlncipale  de  perturbation. 

II  faut  ensuite  passer  3  la  raise  en  place  des  diperdlteurs  passlfs,  destines  3 
limiter  les  effets  des  dicharges  corona  sur  les  antennes.  Cette  mlse  en  place  est  pri- 
vue  de  faqon  qu'aucune  decharge  corona  ne  s'amorce  sur  des  parties  non  protigies  de  la 
cellule  ;  elle  doit  tenir  corapte  des  facteurs  suivants  seull  d'amorqage  des  dicharges 
sur  les  deperd lteurs ,  courant  maximum  du  diperdlteur  pour  diflnlr  leur  nombre  en  fonc- 
t  ion  du  courant  de  charge  maximum  escompti,  Influence  riclproque  entre  diperdlteurs  di- 
f  Inlssant  une  distance  minimum  entre  ces  dlsposltlfs.  Blen  entendu,  la  connalssance  du 
champ  k lec t ros tat  lque  3  la  surface  de  la  cellule  est  indispensable  pour  effectuer  cette 
etude.  La  mlse  en  place  des  diperdlteurs  est  enfln  afflnie  en  tenant  compte  des  effets 
de  resonance  d  lmens  ionne 1 le  de  l'aironef  dans  la  gamme  des  friquences  de  travail  des 
antennes  :  11  faut  en  effet  ivlter  des  effets  d *  amp  1  if lcat Ion  du  bruit  r ad  loi lec t r lque 
des  dicharges  corona  par  ces  resonances • 

Lorsque  1 '  Imp  1  an t a t  ion  des  diperdlteurs  a  a  Ins  1  iti  effectuie,  11  est  utile 
d'effectuer  un  test  pour  ivaluer  son  efflcaclti.  On  procide  alors  3  un  essal  au  sol,  en 
Isolant  l'aironef  et  en  le  portant  3  un  potentlel  ilectrlque  ilevi.  L'expirlence  montre 
que  ce  test  est  difficile  3  riallser,  car  11  est  pratlquement  Impossible  de  reprodulre 
au  sol  le  champ  ilectrlque  existent  en  vol.  Par  allleurs,  l'icoulement  airody nanlque 
Introdult  en  vol  des  variations  de  presslon  qul  modlflent  localement  les  conditions  de 
dicharges  corona.  On  est  done  conduit  3  effectuer  un  essal  en  vol. 


1 1 . 5  -  Caractirlgation_sygt|matigue_en_yql_de_lMm£gct_de_l^ilectrlciti 

ataiiaue.sur.is.f  0n£U0Qns9S!!i_4es.sXSi4asa-dS-rsdJ2;£23Sttni£at  J2S.££ 
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Nous  cholslrons  l'exeaple  d'une  caapagne  d'essals  en  vol  rtsllste  en  France  aur  un 
avion  METEOR  spCcialeaent  lnstruaentl  (fig.  6).  L'annexe  I  donne  lea  conditions 
prtclsea  de  cette  caopagne.  Nous  soullgnerona  ai.ple.ent  icl  lea  falts  salllants  qul 
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permettent  de  sltuer  le  caractJre  ginSral  et  dc  degager  lea  apports  esaentlela  de  ce 
type  d'essai. 

1)  L’aSronef  doit  avoir  subi  le  traiteoent  complet  de  mS t a  1 1  Isa t ion  et  de  tralte- 
ment  an t is t a t ique ,  pour  Sliminer  tout  effet  d'Stincelle  et  de  dScharge  de  surface. 

2)  L'aSronef  doit  itre  tria  fortement  instruments  (11].  Farsi  lea  paramltres  qu'll 
eat  nScessalre  de  mesurer,  11  faut  clter  : 

-  le  courant  d' Impact  t r ibo-S le c t r iq ue ,  mesurS  par  des  sondes  d'  impact,  petltes  surfa¬ 
ces  collectrlces  affleurantes  local isfes  sur  la  zone  frontale  de  1'aSronef  ; 

-  le  courant  traversant  lea  dSperdlteurs  passifs  ; 

-  le  potentiel  (ou  la  charge  Slectrique  totale)  de  1'aSronef  ; 

-  le  champ  Slectrique  a tmos phS r  ique  (troia  composantes)  ; 

-  le  bruit  rad  lo-S lec t r ique  lndult  sur  lea  antennes. 

L’Svaluation  du  potentiel  et  celle  du  champ  extSrleur  aont  effectuSes  par  analyse 
des  mesures  de  champ  Slectrique  superficiel  effectuSes  grace  3  une  disposition  conve- 
nable  de  cinq  soul  ins  3  champ  montSs  affleurants  sur  la  cellule  (on  utilise  cinq 
moullns  pour  avoir  de  la  redondance). 

3)  L'aSronef  dolt  voler  dans  des  conditions  representatives  des  conditions  atmo- 
sphSriques  les  plus  dSfavorables  pour  le  vol  aux  instruments,  en  tentant  de  trouver  des 
c ircons t ance s  ou  les  dlffSrents  facteurs  sont  blen  separes  ;  le  pllote  cherchera,  en 
particuller,  3  caractSrlser  sSparSment  l'effet  de  1' Impact  et  celul  de  1' Influence 
Slec t r os t a t ique  des  nuages  d'orage. 

4)  On  cherche  3  comparer  les  rSsultats  obtenus  sur  1'aSronef  muni  de  sa  protection 
optlmale  en  dSperdlteurs  avec  les  rSsultats  obtenus  sur  le  m§me  aSronef  sans  cette  pro¬ 
tection. 


5)  Dans  ces  conditions,  les  essais  font  apparaltre  les  posslbilitSs  et  les  limita¬ 
tions  de  l'Stat  de  l'art  en  matiSre  de  protection  des  aSronefs  contre  1 ' S lec t r  ic itS 
stat ique . 

L'analyse  de  l'ensemble  des  vols  effectuSs  en  presence  d' Impact,  mats  sans  champ 
Slectrique  externe,  fait  apparaltre  que  le  bruit  r ad io-S lec t r ique ,  qui  atteint  dans  la 
gamme  de  f one t lonneme n t  du  radlo-compas  des  valeurs  de  champ  Slectrique  de  l'ordre  de 
3  mV/m  sans  dSperdlteur,  est  ramenS  par  l'action  des  dSperdlteurs  au-dessous  de 
80  pV/m.  L'efflcacitS  des  protections  contre  l'effet  de  1 ' S lec t r ic i tS  statlque  est  done 
dSmontrSe  dans  ce  cas.  La  situation  est  cependant  modlfi&e  en  prSsence  de  champ  Slec¬ 
trique  a tmosphS r ique . 

Sur  la  figure  7,  on  remarque  une  phase  initiale  caractSrlsSe  par  un  champ  extS- 
rieur  et  une  montSe  du  potentiel  en  absence  d' Impact  ;  en  mSme  temps,  le  bruit  radlo- 
Slectrique  est  notable  ;  11  ne  seoble  pas  que  dans  ce  cas,  les  dSperdlteurs  alent  JouS 
leur  r81e.  L '  in t erpre t a t ion  du  phSnomdne  est  la  sulvante  :  le  champ  Slectrique  extS- 
rleur  eat  sufflsamment  fort  et  son  orientation  par  rapport  3  1'aSronef  sufflsamment 
SlolgnSe  des  plans  de  symStrie  pour  que  les  points  de  champ  Slectrique  superficiel 
maximal  ne  solent  plus  3  1'extrSmitS  des  dSperdlteurs  :  dans  ces  conditions,  des 
dScharges  corona  IncontrSISes  s'amorcent  directement  sur  la  structure. 

Une  telle  configuration  aurait  pu  passer  totalement  lnaperque  sans  essai  de  carac- 
tSriaatlon  systSmatlque  en  vol.  Les  conclusions  de  l'Stude,  en  attendant  la  mlse  en 
oeuvre  d'un  moyen  opSratlonnel  destinS  3  rSdulre  la  probabllitS  d'apparition  de  dSchar- 
gea  parasites  directement  sur  la  structure,  est  que  le  pllote  dolt  chercher  3  Svlter  la 
proximltS  lmmSdlate  de  certains  types  de  nuages  carac tS r  is t iques  de  l'orage  (cumulus 
congestus)  lorsqu'll  utilise  ses  aides  3  la  navigation  ;  par  contre,  dans  un  aSronef 
convenablement  traitS,  11  peut  les  utlllser  en  toute  qulStude  au  milieu  des  precipita¬ 
tions  en  absence  de  champ  Slectrique  extSrleur.  On  en  didult  aussl  que,  dans  un  aSronef 
convenablement  traitS,  le  bruit  r ad lo-S 1 e c t r ique  rSslduel  qui  se  tradulralt,  dans  les 
Scouteurs,  par  un  bruit  de  friture,  pourrait  Stre  utillsS  par  le  pllote  comme  indice  de 
proximltS  d'un  systSme  nuageux  susceptible  de  provoquer  prSc  ip itat ion  de  grSle  ou  fou- 
drolement . 

Ill  -  INTERACTION  FOUDRE /AE RONE F 


Les  mScanismes  physiques  essentlels  du  foudrolement  d'un  aSronef  seront  rappelSs 
succ  lnctement  dans  ce  chapltre.  La  nature  de  la  menace  sera  dSflnle,  en  Insistent  par- 
t  icul  iirement  sur  la  menace  vls-3-vls  de  l'Avlonique.  Apris  avoir  dScrlt  le  prlnclpe 
des  mesures  de  dure  is sement ,  nous  indlquerons  les  grandes  1  lgnes  des  travaux  de  recher¬ 
che  et  de  dSveloppement  qui  dolvent  aboutir  3  une  protection  optlmlsSe  de  1'aSronef 
contre  la  foudre. 

Les  travaux  de  carac tS r isat ion,  qui  ont  pour  but  de  fournlr  les  rense  lgnements  de 
base  pour  la  recherche  technique,  comportent  une  partle  lmportante  d’essais  systSma- 
tlques  en  vol.  On  indlquera  leur  objectlf  prScls,  les  conditions  de  leur  rSussite,  et 
l'on  cltera  quelques  uns  des  rSsultats  prSl lmlna ires  dSJJ  obtenus. 

III.l  -  MSssnijms.Bhyiiqug.j SjS£ii.SSi.£2MSl2iS9SQt.al!ja.»i£finsf 

La  foudre  est  le  phSnomine  brutal  de  dicharge  Slectrique  dans  l’ataosphlre  par 
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lequel  les  charges  Alectriques  positives  et  negatives  accumulees  dans  les  nuages,  ainsl 
que  leurs  images  £lectriques  au  sol,  se  neutral  lsent .  Les  f oud r o  ierae n t s  correspondents 
peuvent  2tre  int ra-nuage s ,  int er- nuages ,  ou  nuage-sol.  Ce s  f oudroiements  sont  precedes 
par  une  p£riode  de  pr£-claquage  (pre-breakdown)  A  l'lnt£rleur  du  nuage,  puis  par  la 
progression  d'un  canal  lonis£  dit  precurseur  (leader)  qui  Atabllt  un  pont  conducteur 
entre  centres  de  charges  oppos£es.  DAs  que  le  circuit  est  ferm£,  un  courant  de  court 
circuit  intense  le  traverse  A  une  vltesse  qui  est  une  fraction  de  celle  de  la  lumlAre. 
C'est  le  coup  en  retour  (return  stroke),  responsable  des  effets  lumineux  de  l'Aclair  et 
qui  provoque  l'onde  de  choc  perque  sous  forme  de  tonnerre. 

La  phase  de  pre-claquage  peut  durer  une  fraction  de  seconde,  la  progession  du 
leader  quelques  mil 1 isecondes r  le  coup  en  retour  quelques  dlzalnes  de  m lcrosecondes  ; 
un  mAme  Eclair  peut  comporter  plus ieurss  dizaines  de  precurseurs  et  coups  en  retour 
pendant  une  duree  totale  de  1'ordre  de  la  seconde  ;  dans  de  nombreux  cas,  le  canal 
lonlsA  est  parcouru  entre  les  coups  en  retour  par  un  courant  persistant*  Le  precurseur 
peut  transporter  500  Amperes,  le  coup  en  retour  est  inf£rleur  A  200.000  AmpAres  dans 
98  X  des  cas  ;  le  courant  persistant  peut  valoir  plus leurs  centalnes  d'AmpAres. 

Un  a£ronef  peut  etre  frappA  par  la  foudre  pour  plus  leurs  raisons  : 

a)  dans  un  premier  scenario,  un  precurseur  descendant  passe  A  proximite  de  l'apparell  ; 
comme  il  s'accompagne  d' un  champ  Alectrique  trAs  Intense,  il  amorce  sur  l'a&ronef 
une  decharge  (streamer)  qui  se  transforme  en  precurseur  ascendant  ;  les  deux  pr£cur- 
seurs,  qui  comportent  de  nombreuses  branches,  se  rencontrent  ;  l'apparell  est  port£ 
au  potentiel  du  nuage  et  Inet  vers  le  sol  un  precurseur  descendant  ;  dAs  que  ce  pri- 
curseur  est  en  contact  avec  le  sol,  le  coup  en  retour  remonte  vers  1'aAronef 
(fig*  8)  ; 

b)  un  second  scenario  est  aussi  possible  :  l'avion,  plonge  dans  le  champ  £lectrlque 
trAs  Intense  d' un  nuage  d'orage,  volt  s'amorcer  sur  ses  pointes  une  decharge  qui 
fournlt  un  precurseur  ascendant  vers  le  nuage  :  la  suite  des  AvAnements  se  passe 
comme  dans  le  premier  scenario,  ma is  lei  le  coup  de  foudre  a  £te  declenchA  par  la 
presence  mAme  de  1'aAronef. 

111. 2  -  Nature_de_la_menace_due_|_la_foudre 

Co nt r a ir emen t  A  la  menace  due  A  1 ' 6 lect r  ic  ite  statlque,  la  menace  de  la  foudre  se 
caractArise  par  une  action  d’une  extreme  brutalite  mais  de  falble  probability.  Les  sta- 
tlstlques  font  £tat  d' une  frequence  moyenne  de  foudrolement  d'une  fois  toutes  les 
3000  heures  de  vol  pour  les  avions  commerc iaux .  En  general,  sur  la  generation  actuelle 
d'a£ronef,  les  consequences  sont  mlneures  ;  cependant,  l'USAF  a  recens£  la  perte  de 
sept  apparells  au  cours  de  la  derni&re  decennie,  et  des  degats  matAriels  d'un  montant 
de  21  millions  de  dollars  de  1972  A  L977  du  fait  de  la  foudre.  En  effet,  bien  que  les 
mAthodes  de  protection  centre  les  effets  du  coup  de  foudre  direct  sur  la  structure 
alent  AtA  depuls  longtemps  mis  au  point,  il  subsiste  un  petit  nombre  de  cas  qui  se 
soldent  par  des  degats  serleux  et  un  nombre  trAs  redult  d'accidents  ca tas t roph lques 
( Inf lamma t irn  du  combustible  dans  les  reservoirs,  Aclatement  du  radfime,  extinction  du 
r§acteur) .  Ces  effets  et  les  resides  preconisls  ont  fait  l'objet  d'une  abondante  littA- 
rature  sp£clalls£e  ;  nous  n'en  parlerons  pas  ici. 

La  generalisation  des  mat£rlaux  composites,  molns  efflcaces  que  les  panneaux 
mAtalllques  comme  lerans  £ lec t r o-magnA t  lques ,  et  1  *  in t roduc t ion  de  commandes  de  vol 
eiectrlques,  avec  leur  avlonique  dlgltale  sensible  aux  perturbations  rad  io-A lect r  lques , 
transposent  le  problAme  sur  un  nouveau  plan.  La  partle  la  plus  vulnerable  de  l'a£ronef 
devlent  alors  cette  avlonique  destln£e  A  assurer  des  fonctlons  critiques  pour  la  survle 
de  l'apparell  ;  11  convlent  done  de  la  prot£ger  non  seulement  des  consequences  du  coup 

de  foudre  direct,  mais  aussi  des  rayonnements  parasites  en  provenance  des  f oudroiements 
de  proximite,  c'eat-A-dire  des  effets  £lectro-magn£t lques  des  coups  de  foudre  survenant 
dans  un  rayon  de  quelques  dlzalnes  de  kilometres.  Ce  problAme,  qui  constitue  un 
obstacle  A  franchir  avant  le  d£veloppement  du  ContrGle  Automatlque  Generalise,  a  susci- 
t£  l'effort  technolog lque  consacre  A  la  foudre  au  cours  de  ces  dernlAres  ann£es. 

111. 3  -  I*chni<jue8_de_j>rotection_de_l^aylonigue_contre_les_effet8_du 

Nous  ne  ferons,  dans  cette  synthAse,  qu'effleurer  ce  problAme  en  cltant,  parml  les 
techniques  de  protection  (ou  de  dure  is  semen t)  ,  les  dlfftrents  moyens  de  rtdulre  le  cou- 
plage  entre  foudre  et  circuits  senslbles  :  blindages  e  lect  ro-magn£t  lques ,  reduction  de 
la  surface  des  boucles  collectrlces  de  flux  magnetlque  par  utilisation  de  palres  torsa- 
d£es  et  par  un  cholx  Judicieux  des  mlses  A  la  masse,  utilisation  des  circuits  opto- 
£ lect ron lques  pour  la  transmission  des  informations  sur  fibre  optlque  au  lieu  des  fils 
conducteurs,  etc. 

Notons  que  1  *  op t  lm Isa t Ion  de  ce  dure  lssement ,  c'est-i-dlre  la  definition  de  dispo¬ 
sitions  efflcaces  au  polds  et  au  coGt  mlnlmaux,  requlert  une  connalaaance  quantitative 
de  la  source  de  perturbations,  c'est-i-dlre  des  nlveaux  et  du  spectre  de  la  puissance 
rayonnee  par  les  dlff£rentes  phases  du  coup  de  foudre.  En  partlculler,  comme  la  menace 
est  constitute  par  le  champ  parasite  Indult,  la  grandeur  critique  est  ll£e  A  la  vltesse 
de  mont£e  du  courant  de  foudre  dl/dt  et  non  pas  au  courant  1  lul-mtme  ou  A  la  charge 
neutralists  Q  comme  c'est  le  cas  loraqu'on  examine  le  problAme  des  dtgats  mtcanlques  ou 
thermlques  provoquts  sur  la  cellule. 


I 
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1 1 1 . 4  -  Mb thodolog le_de_la_recherche_e t_£u_d£veloggeBent_dan8_le_dona  ine_de_la 
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La  structure  loglque  selon  laquelle  sent  organises  la  recherche  et  le  dbveloppe- 
ment  dans  le  doaalne  qul  nous  lntbresse  est  schbaatlsbe  sur  la  figure  9.  On  relive  les 
etapes  sulvantes  caractbr isat Ion  des  paramitres  de  la  foudre,  £tude  du  couplage  I 
l'abronef,  abthodes  de  dure  Is seaen t ,  abthodes  de  test  au  sol  et  aoyens  d'essai 
c or respondan t s ,  recoaaandat Ions  et  noraes.  Dans  cet  enseable,  le  but  du  present  eiposi 
conalste  3  sltuer  dans  l'enseable  des  travaux  de  ca rac 1 6 r Isa t  Ion  ceux  qul  utlllsent  des 
essals  en  vol  systbaat lques  sur  abronefs  spSclaleaent  bqulpbs.  Nous  renvoyons  le 
lecteur  lntbressb  par  les  autres  aspects  de  ces  travaux  3  la  llttbrature  spbclallsbe 
[12]  [13]  [14]. 

Notons  cependant,  en  liaison  avec  la  conclusion  du  paragraphe  prbebdent,  que  les 
statlstlques  sur  lesquelles  les  r ecoaaandat Ions  actuelleaent  utlllsbes  sont  fondles 
provlennent  pr Inc ipaleaent  de  aesures  falce s  au  sol  dans  des  obse r va t o Ires ,  11  y  a  un 
certain  nombre  d'annbes.  Cecl  lndlque  d'une  part  que  l'on  aanque  de  donnbes  concernant 
les  phbnonines  perqus  3  1'altltude  de  vol  des  avlons,  et,  d'autre  part,  que  l'enseable 
de  ces  travaux  a  btb  reallsb  avec  des  lnstruaents  de  aesure  en  grande  partle  plrlaes 
aujourd'hul,  en  partlculler  en  ce  qul  concerne  leur  bande  passante.  C'est  dire  que  si 
les  rense lgneaents  qu'on  en  tire  sont  sufflsants  pour  estlaer  la  aenace  sur  les  struc¬ 
tures,  llbes  3  I  et  Q,  lls  peuvent  se  rbvbler  troapeurs  pour  l'fvaluatlon  des  effets 
sur  l'Avlonlque,  libs  3  dl/dt,  qul  requlert  une  tris  large  bande  passante  (SO  ou  nine 
200  KHz  dans  les  chalnes  de  aesure  utlllsbes  3  present). 


11  est  done  nbcessalre  de  falre  en  vol  des  aeBures  tris  prbclses,  qul  dolvent  per- 
aettre  de  dbflnlr  les  valeurs  aaxlmales  de  dl/dt,  et  plus  part leui lireaent  de  conflraer 
les  aodiles  btablls  par  les  thborlclens  pour  rendre  coapte  de  Involution  des  chaaps 
electrlques  et  aagnbtlques  de  l'bclair,  ou  £ ve n t ue 1 leaen t  de  coapllter  ces  aodiles  qul, 
3  l'heure  actuelle,  ne  concernent  que  le  coup  en  retour  [15].  Ces  aodiles  sont  en  effet 
critiques  pour  le  cholx  d'une  protection  bquiltbree  contre  les  aenaces  de  la  foudre,  de 
1 ' b lec t r lc 1 tb  statlque  et,  £ ven t ue 1 leae n t ,  de  l'lapulslon  £ lec t ro-aagn£ t lque  [16]  ;  11 

s'aglt  done  de  aesures  dont  l'analyse  entralnera  des  cons£quences  laportantes  sur  la 
philosophic  des  a£thodes  de  dure lsseaent . 

1 1 1 .  5  -  Cargo  t£  r  Isa  t  ion_ajrs  tbna  t  J2ue_en_vgl_des_garani  t  res_b  lec  t  ro-aagnb  t  lgues 
4£2_f2“4£2i£5£S£9_Si££££S_££_5£_fi£25i5i£l 

II  exlste  actuelleaent  trols  prograaaes  en  cours  orlent£s  vers  cet  objectlf  :  an 
prograaae  conduit  par  l'USAF  (Wright  Patterson  Air  Force  Base)  sur  un  C.130,  un  pro- 
graaae  aen£  par  la  NASA  (Langley  Research  Center)  sur  un  F.106  B,  et  un  prograaae  dbve- 
lopp£  en  France  sous  l'£glde  du  SITE  sur  un  C.160  TRANSALL.  Des  essals  syst£aat lques 
mSne  nature  aats  avec  un  apparelllage  r£dult  ont  £t£  conduits,  11  y  a  quelques  ann£es, 
par  l'USAF  sur  un  U2  et,  plus  r£ceaaent,  par  la  NASA,  en  association  avec  le  SRI  sur  un 
Learjet  ;  nous  ne  les  dlscuterons  pas  dans  cet  expos£. 

Les  grandes  llgnes  des  trols  prograaaes  en  cours  apparalssent  dans  l'annexe  II. 
Nous  soullgnerons  alapleaent  dans  ce  paragraphe  les  traits  coaauns  qul  d  If fbrenc lent 
des  essals  en  vol  classlque  ces  op£ratlons  ay s t baa t  lq ues  de  carac t £r laa t Ion . 

1)  L'iqulpement  de  1  'avion  dolt  avoir  (tf  apbclaleaent  btudlb  au  point  de  vue  de 
la  coapa t lb  11 1 1£  £ lec t roaagnb t  lque  ;  c'est  un  vbrltable  laboratolre  volant,  coaprenant 
une  enceinte  btanche  aux  rayonneaenta  dua  3  la  foudre  :  11  faut  en  effet  que  les  chsl- 
nes  £ lec tron lques  dbllcates  ne  solent  pas  soualses  3  l'actlon  parasite  des  perturba¬ 
tions  qu'elles  sont  chargbes  de  aeaurer.  La  solution  gbnbrale  constate  3  abnager  un 
laboratolre  parfalteaent  bllndb  3  l'lntbrleur  d'une  cage  de  Faraday,  oi)  les  lnforaa- 
tlons  pbnitrent  par  fibre  optlque. 

2)  L'abronef  dolt  lire  bqulpb  de  noabreux  capteurs.  Paral  les  paraaitres  qu’ll  est 
nbcessalre  de  mesurer,  cltona  : 

-  le  courant  de  foudre  (sur  perche)  ou  lea  courants  de  peau  lndulta  sur  la  surface 
externe  de  l'appareil  ;  on  aesurera  ces  courants  ou  leur  dbrlvbe  par  rapport  au 
reaps  ; 

-  les  chaaps  aagnbtlques  et  blectrlques,  ou  leura  dbrlvbes,  en  un  certain  noabre  de 
points  cholsla  3  la  surface  extbrleure  de  l'avton  ; 

-  le  chaap  blectrlque  statlque  et  le  potentlel  de  l'avlon  (ces  donnbes  sont  utiles  si 
l'on  veut  coaprendre  les  abcanlsaes  de  dbclencheaent  du  foudroleaent  ;  ellea  sont 
sans  IntbrSt  pour  une  btude  des  effets  des  f oudro leaent a  de  proxlaltb)  ; 

-  les  tensions  Indultes  sur  un  certain  noabre  de  boucles  dlsposbes  3  l'lntbrleur  de  la 
cellule,  aux  endrolts  o&  l'avlonlque  dolt  ttre  altube  ; 

-  lea  chaaps  £ lec t ro-aagnb t lques  recueillls  au  aoaent  du  foudroleaent  par  les  antennes 
des  systiaes  de  rad lo-coaaun lest  ion  et  de  radio-navigation. 

II  est  trie  laportant  de  disposer  de  systiaes  de  aesure  3  trie  large  bande  (Jus- 
qu'3  200  MHz)  avec  traneaission  par  fibre  optlque.  Par  ailleurs,  coaae  lea  bvineaents 
lntfresaants  n'occupent  que  des  erbneaux  Ins  ign If lants  du  teapa  total  de  I ' expbr  lence , 
11  est  nbcessalre  de  disposer  3  bord  de  chatnes  ilabories  d' acqu  Is  It  ion  et  de  tralte- 
aent  des  donnbes  ;  une  bonne  solution  conalste  3  digltaltser  les  assures  dans  dea  feni- 
trea  teaporelles  de  durbe  coapatlble  avec  la  partle  lntbreasante  du  phbnoaine  ;  le 
cholx  de  ces  fenbtres  pourra  rbsulter  du  passage  d'un  phbnoaine  cholsl  au-dessus  d’un 
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seull  donnl  ;  on  peut  aussl,  a  van t age u s ene n t ,  recourlr  2  la  mAthode  «ul  conelitc  A  tout 
enreglstrer  et  A  effacer  pA r lod  lquement  la  aiiolre,  sauf  si  un  AvAnement  IntAressant 
s'est  pr£sent£  dans  la  sAquence  enreglstrAe  (systAme  A  aimolrc  tournante)  ;  cet  arti¬ 
fice  permet  d'Atudler  les  mAcanlsmes  prAcurseurs  avant  dAc lenchement  d’un  effet  Im¬ 
portant  . 

Etant  donnA  le  nombre  Important  des  paramAtres  et  le  caractAre  AlaborA  du  tralte- 
ment,  qu'll  faut  complAter  par  un  dlspositlf  de  synchronisation  trAs  prAcls  pour  dater 
correctement  des  phAnomAnes  dont  certains  ont  la  dlzalne  de  nanosecondes  pour  temps 
c a rac t A r  Is t  lq ue ,  on  conqolt  la  complexitA  des  systAmes  de  traltement  de  donnAes  nAces- 
salres  :  on  est  A  la  llmlte  de  ce  que  la  technique  peut  offrlr,  dans  un  domalne  ou 
1 ' appare 11 lage  se  perfectlonne  d'une  annAee  A  l1 autre-  Par  allleurs,  on  comprend  aussl 
le  soln  qu'll  faut  consacrer  aux  Atalonnages  prAalables  en  niveau  et  en  frequence  des 
capteurs,  en  prenant  blen  soln  d'opArer  In  situ.  Enfln,  1 ' In t er pr A t a t Ion  des  rAsultats 
n'est  pas  Avldente  et  pose  de  dAllcats  problAmes  de  thAorle  fleet  ro-nagnA  t lque  ;  11 
s'aglt  done  encore  de  recherche,  domalne  ou  1'lngAnleur  dolt  collaborer  Atroltement 
avec  le  chercheur  si  l'on  veut  evlter  les  conclusions  erronAes. 

Une  consequence  Avldente  de  cette  complexitA  est  la  nAcessltA  absolue  d'utlllser 
des  avlons  trAs  spAclallsAs,  et,  d'autre  part,  1 ' Imp  os s lb  11  It A  d'aboutlr  A  un  rAsultat 
en  une  seule  campagne  :  les  essals  se  dAroulent  en  plusleurs  campagnes  pendant  la  sal- 
son  favorable  de  plusleurs  annAes  consAcutlves  ;  la  premiAre  de  ces  campagnes  sert  A 
mettre  au  point  le  systAme  ;  elle  entralne  des  modifications  qul  sent  essayAes  1'annAe 
sulvante  ;  ce  n’est  souvent  qu'au  bout  de  la  troislAme  annAe  que  les  premiers  rAsultats 
s  lgn If lcat If s  sont  obtenus. 

3)  [.'avion  dolt  voler  au  volslnage  de  systAmes  orageux,  et  dolt  mAme  pAnAtrer  A  la 
llslAre  des  zones  de  prAc  lp ltat  Ion  si  le  foudrolement  direct  est  recherchA.  La  configu¬ 
ration  la  plus  favorable  A  1' analyse  est  celle  qul  combine  les  essals  en  vol  et  les 
mesures  au  sol  :  on  peut  alnsl  disposer  de  stations  qul  permettent  de  locallser  les 
coups  de  foudre  de  proximltA  par  rapport  A  1 ' avion,  ce  qul  permet  d'estlmer  les  termes 
source  du  rayonnement  A  part lr  des  mesures  sur  l'avlon  et  au  sol. 

4)  Le  respect  de  ces  conditions  est  Indispensable  pour  obtenlr  des  rense lgnement s 
crAdlbles.  Void  quelques  rAsultats  prA 1  lm lna Ires  des  campagnes  en  cours  (un  plus  grand 
nombre  de  rAsultats  dolt  Atre  publlA  en  Ju  In  1983  au  cours  d’une  confArence  spAcla- 
llsAe)  [17], 

-  F-106B  :  de  1980  A  1981,  vlngt  coups  de  foudre  directs  enreglstrAs.  Ces  essals  ont 
mis  en  lumlAre  1'  Importance  des  rAsonances  d  lmens lonnel les  de  l'avlon,  qul  ampllflent 
certalnes  composantes  de  la  gamme  HF  (7  A  21  MHz).  Les  seiurei,  effectuAes  avec  une 
bande  passante  de  50  MHz,  montrent  des  fronts  de  montAe  de  l'ordre  de  25  kA  par  ps. 
Par  allleurs,  certains  Aclalrs  comportent  jusqu'A  une  centalne  d'  Impulsions  rApartles 
sur  un  peu  molns  d'une  seconde  [18]. 

-  C-130  :  de  1979  A  1981,  deux  coups  de  foudre  directs  enreglstrAs,  plusleurs  mllllers 
de  f oud ro  lemen 1 8  de  proxlmlte  (dans  un  rayon  de  5  A  35  km)  analysAs.  On  dAdult  de  la 
corrAlatlon  entre  les  champs  Alectrlques  et  magnAtlques  mesurAs  dans  la  phase  de  pro¬ 
pagation  du  leader  que  e'est  la  prAsence  de  l'avlon  qul  a  dAclenchA  les  deux  fou- 
drolements  directs.  Pour  les  f oud ro lement s  de  proximltA,  les  formes  d'onde  observAes 
sur  l'avlon  sont  ldentlques  A  celles  observAes  au  sol.  On  trouve  aussl  une  amplifi¬ 
cation  par  rAsonance  d  lmens lonne 1 1 e  de  composantes  HF  (2  A  5  MHz).  Cependant,  ces 
rAsonances  ne  sont  pas  excitAes  si  le  foudrolement  est  distant  de  plus  de  5  km. 

Les  temps  de  montAe  des  coups  en  retour  varlent  de  plusleurs  mlcrosecondes  A 
100  nanosecondes  ;  cependant,  on  note  la  prAsence  de  nombreusea  Impulsions  A  front  de 
montAe  trAs  ralde  pendant  les  pArlodes  de  prA-c 1 aquage .  On  peut  en  dAdulre  que  le 
danger  pour  l'avlonlque  ne  provlent  pas  exc 1  us  1 vemen t  des  coups  en  retour  [19]. 

-  C-160  :  en  1978,  seize  f oud ro leme n t s  directs.  L'Aqulpement  de  mesure  a  subl  des  modi¬ 
fications  et  les  vole  de  1981  ont  servl  A  sa  mlse  au  point  ;  aucune  conclusion  dAfl- 
nltlve  n'a  done  pu  Atre  publlAe  A  ce  jour  [20]  [21]. 

L'analyse  de  ces  rAsultats  p r A 1 lm  lna  Ire s  appelle  les  remarques  sulvantes  : 

1)  II  ne  faut  pas  attendre  de  ces  expArlences  une  rAponse  raplde  aux  questions 
encore  ouvertes  sur  les  csractAr  1st  lques  cherchAes  :  la  rAponse  vlendra  A  la  fin  de  la 
pArlode  de  dApou 11 lement  et  d'analyse,  c'est-A-dire  vers  le  milieu  de  la  prAsente 
dAcennle.  Cette  lourdeur  expAr  lmenta  le  est  le  prlx  de  la  complexitA  d ' expA r  lences  des- 
tlnAes  A  mesurer  les  paramAtres  d 1 f f  1c 11 emen t  accesalblea  d'un  phAnomAne  essentlelle- 
ment  fugltlf.  On  tente  actuellement  de  recuellllr  des  mesures  compl Amenta  ires ,  mats  qul 
n'ont  pas  la  rlgueur  des  mesures  sys t Ama t  lque s  que  nous  avons  dAcrltes,  sur  certains 
avlons  de  llgne,  grice  A  des  "boltes  nolres"  qul  mesurent  les  perturbations  Alectroaa- 
gnAt  lques  avec  une  bande  passante  de  l'ordre  du  MHz.  Ces  mesures  complAmenta  Ires  ne 
sauralent,  A  elles  seules,  donner  la  rAponse  cherchAe. 

2)  Les  donnAes  obtenues  par  chaque  campagne  sont  trop  peu  nombreusea  et  les  mAtho- 

des  de  mesure  trop  dAllcates  pour  que  les  conclusions  pulssent  Atre  tlries  rapldeaent 
par  chaque  e xpA r  lmen t a t eur  :  seule  la  confrontation  des  rAsultats  et  des  mAthodes  peut 
condulre  A  la  constitution  d'une  banque  de  donnAes  qul  pulssent  Atre  ra  lsonnablement 
consldArAe  cone  valable  :  11  s'aglt  done  d'un  domalne  oil  la  coopAratlon  est  Indispen¬ 

sable  et  oil,  par  allleurs,  elle  ne  se  heurte  A  aucun  obstacle  de  conf  ldent  lal  ttA  pour 


dee  raisons  mllltalres  ou  coaaerc isles .  Dans  ces  conditions,  cette  cooperation  a  prls 
une  dimension  Internationale  aussl  blen  par  1* organ lsat ion  de  Conferences  specialises 
que  par  application  d'accords  d'Cchanges  d '  Inf oraat Ion  et  de  personnel. 

IV  -  CONCLUSION 

L ' lntroduct ion  des  coaaandes  de  vol  eiectrlque  (CAG)  et  la  generalisation  des 
revdteaents  composites  rendent  part  lcul lfereaent  urgentes  lea  etudes  relatives  A  la 
menace  que  1' dlectr ic ite  atmosphCr  ique  fait  peter  sur  le  f onct lonneaent  op€ratlonnel 
des  systiaes  avlonlques. 

Paral  ces  etudes,  la  caracterisat ion  systematlque  des  effets  de  1 ' 6 lec t r lc ite 
a taos phe r lque  sur  les  conditions  operat ionnelles  des  aeronefs  requlert  des  essals  en 
vol  afln  de  dAflnlr  les  paranilres  physiques  encore  inconnus  de  la  menace.  Ces  para- 
aitres  une  fois  connus,  on  pe  c  opt  ialser  les  systAaes  de  protection  qul  permettront  A 
l'aeronef  de  voler  par  tout  temps  dans  les  conditions  de  sAcurltA  requlses.  L'optlai- 
sat  Ion  deaande  des  etudes  c omp lemen t a lr es  (couplage,  dur c Is seaent ,  mAthodes  de  test  au 
sol)  qul  ne  sont  pas  d€crltes  dans  cette  synthAse. 

Les  essals  en  vol  nAcessalres  sont  longs  et  dAllcats  ;  11s  exigent  des  avlons 
munis  d' une  Instrumentation  trAs  Alaboree.  Le  dApou 11 lement  des  aesures  et  l'analyse 
des  rSsultats  dolvent  falre  l'objet  de  noabreuses  confrontations  entre  Aqulpes  de  cher- 
cheurs  :  c'est  un  domalne  o&  la  collaboration  Internationale  peut  ajouter  une  grande 
valeur  A  la  qualitA  de  la  recherche. 
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ANNEXE  I 


La  campagne  de  mesure  METEOR  NF  11  du  Centre  d'Essals  en  Vol  de  BrEtlgny,  a  EtE 
organlsEe  en  1979  (18  vols)  et  1980  (10  vols)  sous  l'Eglde  du  STTE  avec  la  participa¬ 
tion  du  CEAT,  de  1 • Afirospat tale  et  de  l'ONERA. 

1  -  Instrumentation 


Cet  appareil  Etalt  EquipE  de  trols  sondes  de  courant  d' Impact  sltuEes  respectlve- 
ment  sur  le  raddme  et  sur  le  bord  d'attaque  de  chaque  vollure  et  de  cinq  capteurs  de 
champ  6 lec t ros t a t lque  type  moul In  3  champ  pour  la  mesure  du  champ  Electrlque  extErleur 
et  du  potentiel  de  l'avlon  (voir  figure  6). 

La  possibility  de  monter  jusqu'3  trente  et  un  deperdlteurs  pass  If s  instrument's 
etalt  prevue.  Certains  vols  Etalent  effectuEs  avec  seulement  deux  deperdlteurs  destlnEs 
3  Sviter  l'apparltlon  de  dEcharges  corona  sur  les  pitots. 

Le  niveau  des  bruits  rad loE lec t r lq ue s  Etalt  releve  dans  les  gammes  de  frequence 
VLF  (10  kHz ,  navigation  OMEGA),  MF  (350  kHz,  rad  lo-compas) ,  HF  (20  MHz,  rad  locommu n 1- 
catlon),  VHF  (130  MHz,  V0R)  et  UHF  (379  MHz,  rad lonav  lgat Ion  et  rad locommun icat ion) . 

2  -  CaractEr la t lques  des  programmes  de  vol 

Les  vols  effectuEs  ont  EtE  programmes  pour  avoir  lieu  le  plus  souvent  3  1'lntE- 
rleur  des  nuages.  La  frEquence  d'occurence  de  1'  Impact  est  Elevee  :  508  minutes  d' Im¬ 
pact  pour  1440  minutes  de  vol,  solt  35  X  du  temps,  au  cours  des  18  vols  de  1979.  On  a 
trouve  que  le  courant  d' Impact  obtenu  dans  les  cirrus  (altitude  10-15  km)  Etalt  molns 
contlnu  et  molns  Intense  que  celul  mesure  dans  les  formations  convectlves  plus  basses 
(alt  lcumulus ,  congestus)  .  La  campagne  de  mesure  de  1980  s'est  dEroulee  prEfErent iel- 
lement  dans  des  nuages  bas  et  l'on  a  obtenu  310  minutes  d* Impact  pour  614  minutes  de 
vol,  solt  49  Z  du  temps.  Les  valeurs  des  courants  d' Impact,  rapportEs  3  la  surface 
frontale  de  l'avlon,  vont  de  25  3  60  pA/m?  a  haute  altitude  ;  11s  dEpassent  3  basse 
altitude  150  pA/m?,  avec  des  points  autour  de  400  pA/m^, 

3  -  REsultats  prlnclpaux 

Le  potentiel  de  l'avlon  peut  attelndre  300  kV.  Le  champ  Electrlque  extErleur  peut 
attelndre  100  kV/m.  II  commence  3  produlre  des  effets  de  charge  par  Influence  3  part lr 
de  valeurs  de  l'ordre  de  10  kV/m.  Le  bruit  rad loElectr lque  apparalt,  malgrE  la  prEsence 
des  dEperdlteurs,  sous  l'effet  combine  du  potentiel  de  l'avlon  et  du  champ  extErleur. 

Dans  le  domalne  MF  (r  ad  lo-comp  as)  ,  le  niveau  de  bruit  qul  attelnt  3  mV/m  en 
l'absence  de  protection  est  ramenE  au-dessous  de  80  pV/m  dans  les  conditions  les  plus 
sEvEres  lorsque  l'avlon  est  EqulpE  de  dEperdiceurs  passlfs.  Cependant,  1'effleacltE  de 
cette  protection  par  dEperdlteur  dEcrolt  fortement  en  prEsence  du  champ  Electrlque 
externe  dfl  3  la  proxlmltE  de  nuages  chargEs  Electr  lquement ,  probablement  par  suite 
d'amorqage  de  dEchsrges  corona  dlrectement  sur  la  structure. 

ANNEXE  II 
1)  F-106B 


Le  programme  de  mesures  en  vol  sur  la  foudre  de  la  NASA,  organlsE  en  liaison  avec 
le  Centre  Technique  de  la  F.A.A.,  s'est  Etendu  sur  une  premltre  pErlode  de  deux  ans 
(EtEs  de  1980  et  de  1981).  L'avlon  est  un  F-106B  Instruments  avec  des  capteurs  de  champ 
Electrlque  statlque,  des  capteurs  fournlssant  les  dErivEes  des  composantes  Electrlques 
et  magnEtlques  du  champ  E lec tromagnE t  lque ,  et  des  capteurs  de  courant  (et  de  dErivEe  du 
courant).  Ces  derniers  capteurs  sont  montEs  3  la  base  d'une  perche  montSe  1  l'avant.  Le 
nombre  et  la  position  des  autres  capteurs  sont  tels  qu'ils  pernettent  la  mesure  de 
toutes  les  composantes  spatlales  des  grandeurs  EtudlEes.  La  mission  type  de  l'apparell 
conslste  3  pEnEtrer  dans  forage  pour  obtenlr  un  foudrotement  direct. 
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En  1980,  l'avion  a  ftf  foudroy t  dlx  fols  pour  69  ptnttratlons  dang  l'orage,  et,  en 
1981,  dlx  fols  pour  111  pint t rat  Ions .  Les  20  f oud ro leaen t a  ont  ftt  tous  obtenus 
au-dessus  de  IS  000  pleds  :  30  pfnttratlons  4  une  altitude  lnftrleure  n'ont  paa  ftt 
sulvles  de  f oud ro ieaent a .  Sur  lea  20  coups  de  foudre  directs,  12  ont  ttt  obtenus  entre 
IS  000  et  21  000  pleds  pour  12S  pt nf t ra t  Ions  ,  3  4  25  000  pleds  pour  11  pfnttratlons,  et 
enfln,  S  durant  une  pfnftration  unique  4  33  000  pleds. 

L'ensemble  des  rtsultats  obtenus  lndlque  que  ces  f oudro leaenta  ftalent  tous 
d'lntensltt  aodeste,  le  courant  aaxlaua  sesuri  f tant  de  l'ordre  de  14  kA  [18]. 

2)  C-130 


Le  prograaae  de  mesures  en  vol  sur  la  foudre  de  l'USAF  s'est  f tendu  sur  une  pre¬ 
mitre  ptrlode  de  trols  ans  (1979-1981).  L'avion  est  un  WC-130  Instrument*  avec  des 
capteurs  de  chaap  tlectrlque,  de  cheap  aagnttlque  et  de  densitt  de  courant  de  peau.  Ces 
capteurs  sont  montfs  sur  le  haut  du  fuselage  4  l'avant  de  l'alle,  4  l'extrlaltf  de 
l'alle  gauche,  et  sous  la  queue. 

La  alsslon  essentlelle  de  l'apparell  est  l'analyse  des  effets  t lec t roaagnf t Iques 
des  foudroleaents  de  proxlaltt. 

La  dynaalque  des  chalnes  de  aesure  ftalt  prtvue  pour  aesurer  lee  caractlr  1st iques 
de  foudroleaents  survenant  4  une  distance  comprise  entre  0,5  et  30  km  de  l'atronef.  Lea 
mesures  (talent  dtclenchtes  lorsque  la  variation  du  chaap  tlectrlque  dbpassalt  1 
V/a/s  (augaentat Ion  de  10  V/a  en  1  ps). 

La  durte  des  fvtnements  enreglstrts  ttalt  courts  :  11  s'aglt  de  fenttres  de  40  ps 

en  1979,  de  164  pis  en  1980.  C'est  dire  que  les  donnfes  utiles  couvrent  une  durte  totale 
de  quelques  secondes  pour  une  caapagne  de  vol. 

L'avion  survolalt  le  site  de  Devil's  Carden,  en  Florlde,  4  une  altitude  aoyenne  de 
IS  000  pleds,  quolque  des  aesures  alent  ttt  relevtes  4  8  000,  S  000  et  aCae  1  500 

pleds.  Une  Infrastructure  coaprenant  un  shelter  d '  Ins t ruaen t a t Ion  peraettalt  d'effec- 
tuer  des  correlations  avec  des  aesures  au  sol  (chaap  tlectrlque,  rayonneaent  VHF). 

L' lnstruaentat  ion  eabarqute  coaprenalt,  outre  le  radar  attto,  un  "s t orascope “ 
capable  de  locallser  gross 14reaent  les  foudroleaents. 

A  cltre  d'exeaple,  nous  dterlrons  le  foudroleaent  en  vol  du  26  aoOt  1981,  qul  a 
et*  obtenu  lorsque  l'avion  volalt  4  la  Vitesse  de  333  ka/h,  4  1'altltude  de  16  000 
pleds,  avec  une  teapfrature  exttrleure  de  +  5*C,  sous  un  cuau lo-n labus  (soaset  des 
nuagea  30  000  pleda).  L'Cclalr  a  dur*  460  as,  avec  une  prealtre  phase  de  30  as  forate 
d'  Impulsions  durant  quelques  a ic rosecondes ,  stpartes  de  quelques  dlzalnes  de  alcro- 
secondes,  et  une  seconde  phase  stparte  de  la  prealtre  par  une  ptrlode  calae  de  320  as. 
II  a'eat  accoapagnt  d'un  bruit  violent  ;  l'fqulpage,  qul  a  une  grande  experience  du  vol 
par  aauvalaea  conditions  at tforolog  Iques ,  a  estlat  que  1 ' a 1 1 acheaen t  de  la  foudre 
s'ftalt  fait  de  part  et  d'autre  du  fuselage  [19]. 

3)  TRANSALL  C-160 


Le  prograaae  de  aesure  en  vol  du  TRANSALL  C160-04  du  CEV  de  Brttlgny  devalt 
s'ttendre  en  prlnclpe  sur  1978  (experiences  de  dtgross lssage)  et  sur  1981,  aprts  ame¬ 
lioration  dea  chalnes  de  aesure.  En  fait,  l'avion  n'a  prat lqueaent  pas  volt  en  1981,  et 
les  seules  aesures  dont  on  dispose  sont  celles  de  1978.  Coaae  pour  le  F106-B,  la 
alsslon  coaportalt  la  ptnttratlon  en  llsltre  de  zone  orageuse  pour  obtenlr  des  fou¬ 
droleaents  directs.  L'apparell  ttalt  tqulpt  en  1978  de  perches  avant  et  arrltre  et  d'un 
shunt  de  aesure  du  courant,  de  capteurs  de  chaap  aagnttlque,  et  de  capteurs  de  courant 
de  peau.  La  figure  10  aontre  l'aspact  de  l'apparell  avec  la  perche  avant  ;  la  figure  11 
rasseable  des  cllchts  aontrant  dlfffrents  capteurs  dont  l'apparell  a  ttt  tqulpt  aprte 
la  rtvlslon  pour  la  caapagne  de  1981.  Ces  capteurs  sont  ripartls  sur  l'avion  coaae  le 
aontre  la  figure  12  [20]. 

L'avion  a  volt  au-dessus  ds  touts  Is  France,  4  une  vltesse  coaprlse  entre  170  et 
220  noeuds.  Au  cours  de  7  vols  (17  heures  de  vol),  on  a  obtenu  19  foudroleaents,  4  des 
nlveaux  de  vol  coaprls  entre  10  000  et  IS  000  pleds  ;  Is  teaptrature  extirleure  ftslt 
coaprlse  entre  -S  et  0*C.  L'avion  pfnitralt  au  plus  4  1  ou  2  ailes  nautlques  4  1* intf- 
rleur  du  nusge,  et  fprouvslt  une  turbulence  aoyenne,  accoapsgnfe  de  prtc ip  It  at  Ion  (en 
genfral  grtle). 

Le  niveau  des  foudroleaents  ftslt  plus  flevt  que  pour  le  F-106B  10  t  des  fou¬ 
droleaents  dfpassalent  SO  kA  [21]. 
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Fig.  1  -  Dicharges  ilectriques  provoquies 
par  I'ilectriciti  statique. 


Fig.  2  -  Dicharges  de  surface  l surface  streamer). 
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Fig.  3  —  Forme  typique  d'une  impulsion  de  Trichel. 
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Fig.  4  -  Spectre  de  la  puissance  rayonnte  par  la  dicharge 
Corona. 
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Fig.  5  -  Diperditeurs  passifs. 
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Fig.  6  -  Avion  METEOR  utilise  par  le  CEV pour  revaluation 
an  voi  des  effets  des  charges  e/ectrostatigues. 
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Fig.  7  -  Analyst  dm  rtsuitats  da  la  campagna  da  maaurm  du  METEOR  du  CEV. 
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c)  First  return  stroke 


Fig.  9  -  Organigramme  logique  des  operations  de 
recherche  et  de  diveloppement  sur  la  protection  des 
aironefs  contre  la  foudre  Id'apris  \  12\). 


10-14 


FM  :  field  mill  -  IS  ;  impact  sensor 
E  :  E  sensor  -  B  :  B  sensor  -  il 
I  |  :  current  sensor 


Fig.  12  -  Repartition  des  capteun  sur  le  TRANSALL 
C-160du  CSV. 
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SUMMARY 

'Large  changes  of  wind  and  downdraughts  (Wind  Shears)  have  caused  several  major 
accidents  to  airliners.  The  Royal  Aircraft  Establ ishment ( RAE , ,  with  support  from  the 
United  Kingdom  Civil  Aviation  Authority  and  British  Airways(BA),  have  analysed  wind  shear 
data  from  over  9000  landings  by  26  BA  B747  aircraft  at  71  airports  around  the  world 
during  1981  and  1982.  The  data  are  analysed  using  Discrete  Gust  methods  developed  at  the 
RAE. 


Time  histories  of  wind  velocities  and  aircraft  reactions  are  presented  for  9  of  the 
more  interesting  events  identified.  These  were  selected  from  86  examples  of  large  wind 
shears  where  the  three  components  of  wind  velocity  have  been  calculated.  An  example  of  a 
severe  downburst  in  the  vicinity  of  a  thunderstorm  is  also  presented.  This  was  measured 
by  the  RAE  HS125  research  aircraft  during  the  Joint  Airport  Weather  Studies  (JAWS) 
Programme  near  Denver,  Colorado,  USA  in  July  1982. 

Statistics  on  the  probabilities  of  encountering  wind  shears  with  particular 
patterns  of  headwind  speed  changes  have  been  calculated  from  the  9000  landings.  Effects 
at  different  airports,  height  bands,  shear  lengths,  and  patterns  have  been  compared. 
Suggestions  are  made  for  Design  Cases  of  shear  that  could  be  used  for  testing  autopilots 
and  wind  shear  measuring  systems.  Some  possible  criteria  for  the  severity  of  single  ramp 
changes  in  headwind  are  presented. 


1  INTRODUCTION 

Large  changes  of  wind  and  downdraughts  (Wind  Shears)  have  been  the  cause  of  several 
major  accidents.  The  worst  and  one  of  the  most  recent  accidents  occurred  during  take-off 
from  New  Orleans  during  July  1982  (Ref  1).  A  Boeing  727  aircraft  was  taking-off  with 
thunderstorms  in  the  vicinity  of  the  airport  and,  despite  making  allowances  for  a 
possible  encounter  with  wind  shear,  the  aircraft  crashed  killing  153  people  (Ref  1). 
Many  research  activities  have  been  addressing  the  problems  of  wind  shear  since  the 
mid-1970's  with  particular  emphasis  on  flying  techniques  and  the  development  of  suitable 
flight  deck  displays  and  wind  shear  sensors.  Regulatory  Authorities  have  not  been  able 
to  use  this  research  to  produce  practical  rules  but  only  advice  on  flying  techniques  and 
ground  based  wind  shear  warning  systems.  This  is  understandable  as  it  is  not  possible  to 
produce  meaningful  rules  unless 

a)  acceptable  sensors  and/or  display  systems  have  been  demonstrated,  and 

b)  wind  shear  design  cases  have  been  established  for  testing  such  systems. 

One  of  the  reasons  for  the  unwillingness  to  accept  various  sensors  and  systems  is 
the  scarcity  of  data  from  which  to  provide  design  cases  of  wind  shear.  Such  design  cases 
must  be  realistic  in  their  form  with  time  and  position,  their  size,  and  their  probability 
of  encounter.  Until  recently  the  only  data  available  on  large  wind  shears  were  a  few 
reconstructions  from  major  accidents  and  limited  data  from  instrumented  masts.  There 
were  no  data  on  the  probabilities  of  encountering  wind  shears  of  a  particular  form  and 
size,  although  the  loss  of  1  or  2  commercial  airliners  each  year  through  wind  shear  shows 
that  the  probability  of  encountering  a  catastrophic  wind  shear  is  significant.  The  need 
for  such  data  is  indicated  by  the  US  Federal  Aviation  Administration's  issue  of  a  Draft 
Advisory  Circular  (No.  120)  giving  several  examples  of  wind  shear  that  may  be  used  for 
testing  sensors  and  displays.  However,  the  examples  used  are  based  on  the  limited  data 
from  accidents  and  masts. 

Some  four  years  ago  the  UK  Royal  Aircraft  Establishment  (RAE)  with  support  from  the 
UK  Civil  Aviation  Authority  (CAA)  approached  British  Airways  (BA)  with  a  view  to 
obtaining  wind  shear  data  during  landings  from  the  routine  flight  recorders  carried  on 
many  of  their  aircraft.  British  Airways  were  interested  in  obtaining  wind  shear  data  to 
assist  in  the  interpretation  of  unusual  events  and  a  programme  was  agreed  whereby  the  RAE 
would  provide  BA  with  detailed  methods  for  detecting  and  analysing  headwind  components  of 
wind  shear  (Ref  2)  and  BA  would  provide  relevant  records  to  the  RAE  for  more  detailed 
analysis.  The  programme  would  analyse  data  from  the  26  B747  aircraft  in  the  BA  fleet  and 
the  aim  was  to  collect  the  final  two  minutes  of  about  12000  landings. 

This  paper  briefly  describes  the  analysis  methods  used  to  identify  wind  shears  from 
over  9000  landings  during  1981  and  1982.  The  paper  starts  with  the  scope  of  the 


measurements,  then  several  examples  are  given  of  different  types  of  shear,  followed  by 
the  identification  of  differences  between  various  airports  and  the  effects  of  height 
above  the  ground.  The  form  of  statistical  distribution  of  wind  shears  for  this  part  of 
the  BA  route  structure  is  presented  and  ways  of  using  these  data  to  provide  design  cases 
are  described. 

2  WIND  SHEAR  PROGRAMME 

2.1  Programme  Aims 

The  programme  has  three  aims: 

a)  To  provide  statistics  on  the  probabilities  of  encountering  severe  wind  shear 
of  various  patterns  both  at  individual  airports  and  in  a  worldwide  route  structure. 

b)  To  provide  a  variety  of  examples  of  large  wind  shear  to  improve  the 
understanding  of  the  different  forms  of  shear  and  the  associated  aircraft 
behaviour . 

c)  To  prove  the  effectiveness  of  the  Discrete  Gust  Analysis  methods  (Ref  3)  in 
detecting  wind  shears  and  provide  a  method  for  routine  application  at  British 
A i rway s  . 

From  these  results  it  is  expected  that  recommendations  will  be  made  on  the  forms 
and  magnitude  of  various  wind  shear  patterns  to  be  used  for  wind  shear  design  cases.  It 
is  also  suggested  that  the  analysis  methods  are  particularly  suited  to  the  analysis  of 
wind  shear  for  aviation  applications  in  an  economical  and  effective  manner  and  as  such 
could  be  used  as  a  general  method  by  other  agencies.  This  would  have  the  advantage  that 
data  could  be  exchanged  and  compared  from  a  variety  of  sources.  The  discrete  gust  form 
of  the  data  is  particularly  relevant  to  aircraft  operations  BUT  cannot  be  compared 
directly  with  other  statistical  data. 

2.2  Discrete  Gust  Analysis,  or  Wind  Shear  Pattern  Detection 

Aircraft  in  flight  are  unaffected  by  stea../  wind  velocity  except  for  navigation. 
An  aircraft  can  perform  manoeuvres  without  considering  the  wind  velocity.  However,  any 
CHANGE  in  wind  velocity  with  respect  to  the  ground  with  time  or  position  along  the  flight 
path  will  require  action  from  the  pilot  if  the  desired  flight  path  is  to  be  achieved. 
The  extent  of  the  pilot's  actions  will  depend  on  the  duration  and  the  total  size  of  the 
wind  velocity  changes. 

Thus  any  wind  shear  (or  turbulence)  analysis  method  must  identify  size  and  duration 
of  wind  changes  (NB:  It  follows  from  the  above  that  the  change  of  headwind  component 
observed  when  an  aircraft  makes  a  turn  in  a  steady  wind  is  not  a  wind  shear  as  there  is 
no  change  of  wind  velocity  with  respect  to  the  ground.) 

The  next  essential  for  wind  shear  analysis  is  the  ability  to  detect  large  isolated 
events  in  time  histories  of  the  wind.  Traditionally  Fourier  Analysis  methods  have  been 
used  but  they  suffer  from  the  inherent  assuption  that  the  data  can  be  considered  as  a 
portion  of  a  regular  and  continuous  stream  of  data.  The  problems  w>th  isolated  events 
are  clear  if  it  is  remembered  that  the  Fourier  spectrum  of  an  isolated  spike  is  white 
noise  and  only  by  defining  the  relative  phases  of  each  frequency  component  can  the 
presence  of  a  single  spike  be  detected.  Traditionally  fluctuating  data  is  often 
presented  as  only  the  power  spectrum  of  the  data  and  it  would  be  impossible  to  identify  a 
single  spike  from  the  power  spectrum. 

An  alternative  is  to  search  for  particular  patterns  in  the  time  histories  and  the 
Discrete  Gust  methods  developed  by  J  G  Jones  at  the  RAE  have  proved  an  effective  means  of 
analysis  over  many  years  of  turbulence  measurements.  Thus  it  was  chosen  for  the  analysis 
of  the  BA  wind  shear  data. 

The  patterns  chosen  for  wind  shear  analysis  are  shown  in  Fig  1  and  the  analysis 
programme  uses  a  combination  of  smoothing  filters  and  differencing  across  a  given  time 
interval  to  identify  the  size  of  patterns  of  a  particular  length  and  shape.  As  the  data 
are  required  for  defining  wind  shears  that  are  relevant  to  a  wide  range  of  aircraft  the 
time  intervals  chosen  to  define  the  length  of  the  patterns  were  4,  8  and  16  seconds, 
which  correspond  to  air  distances  of  about  300,  600  and  1200  m  at  typical  approach  speeds 
for  the  B747.  Patterns  with  a  shorter  length  would  be  seen  as  turbulence  by  most 
aircraft,  even  at  lower  approach  speeds,  and  not  require  significant  pilot  intervention 
to  hold  the  flight  path.  Patterns  with  a  much  greater  length  will  have  an  extremely  low 
probability  of  having  a  very  large  rate  of  wind  change  and  thus  changes  of  airspeed  will 
be  comfortably  within  the  capabilities  of  the  aircraft  and  pilot. 

The  form  of  analysis  identifies  patterns  within  an  octave  band  of  lengths  where  the 
nominal  length  is  the  centre.  Thus  the  total  range  of  lengths  covered  is  from  200  m  to 
1600  m  for  the  three  single  ramp  patterns  and  up  to  three  times  that  for  the  longest 
double  ramp  patterns.  Fig  2  shows  typical  outputs  from  the  analysis  programme  after 
filtering  and  differencing  for  single  ramps  and  double  ramps  with  zero  spacing  (ie  six  of 
the  twelve  patterns).  Individual  wind  shears  are  identified  by  the  peaks  and  troughs  of 
these  filtered  time  histories.  The  peak  in  the  time  history  (Fig  2a)  at  -17s  is 
correctly  identified  as  an  8s  double  ramp  as  it  is  the  largest  peak  in  the  filtered 
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outputs,  which  is  just  less  than  twice  the  average  headwind  change.  In  this  example  the 
true  average  headwind  change  in  the  double  ramp  is  17  kt. 

2.3  Analysis  of  British  Airways  Landing  Data 

Initially  the  flight  data  are  processed  at  BA  to  extract  headwind,  crosswind, 
aircraft  heading,  and  height  at  1  sec  intervals  during  the  final  2  min  before  touchdown. 
BA  processes  these  data  through  a  simple  wind  shear  identification  programme  and 
identifies 

a)  landings  where  the  magnitude  of  any  shear  pattern  exceeds  a  predetermined 
threshold,  whiclj  are  called  Alerts; 

b)  landings  where  a  combination  of  wind  and  aircraft  heading  change  will  give  a 
significant  false  wind  shear  in  the  headwind  time  history.  These  are  not  checked 
for  Alerts  but  the  data  are  passed  to  the  RAE  for  checking  and,  if  any  possible 
Alerts  are  present,  the  data  are  processed  through  a  more  elaborate  analysis 
programme  which  eliminates  false  shears  arising  from  heading  changes; 

c)  landings  where  more  than  20%  of  the  data  have  lost  synchronization  are 
rejected  at  BA. 

BA  pass  headwind  and  height  data  for  all  landings  to  the  RAE,  other  than  those 
identified  with  (b)  and  (c)  above.  The  data  are  then  subjected  to  a  series  of  tests  to 
identify  runs  with  suspect  data.  These  are  then  visually  inspected  together  with  all 
wind  shears  whose  magnitudes  are  above  those  for  a  5%  probability  of  occurrence.  Only 
those  landings  where  the  data  is  almost  certainly  real  wind  shear  are  retained  in  the 
statistical  data  set.  However,  some  landings  where  corrupt  data  are  well  separated  from 
an  obvious  significant  wind  shear  are  analysed  to  identify  the  wind  shear.  These  are 
kept  separate  from  the  statistical  data.  The  Alert  thresholds  are  set  at  wind  shear 
magnitudes  which  result  in  about  1.5%  of  landings  containing  an  Alert. 

Landings  identified  by  BA  as  containing  an  Alert  are  transferred  to  the  RAE  as  a 
full  set  of  aircraft  data  (Table  1)  which,  if  the  data  are  shown  to  be  valid,  are  then 
analysed  to  determine  a  wide  range  of  relevant  parameters  (Table  1),  including  all  three 
components  of  the  wind  in  earth  axes. 

The  headwind  shear  data  are  collected  by  airport  and  also  sorted  into  height  bands 
between  0,  250,  500,  1000  and  1500  ft,  above  touchdown.  The  data  are  also  amalgamated 

into  a  total  set  for  the  BA  worldwide  route  structure  flown  by  the  B747. 

Analysis  has  been  completed  on  9135  landings  recorded  between  February  1981  and 
September  1982.  This  represents  about  50%  of  the  total  landings  by  the  26  aircraft  of 
BA's  B747  fleet  in  this  period.  It  should  be  noted  that  the  analysis  programmes  use 
parameters  already  recorded  by  BA  and  the  complete  analysis  has  required  about  0.5  man 
years  of  software  development  and  about  0.3  man-years  of  analysis  effort  at  the  RAF. 
Similar  software  effort  was  bought  in  at  BA  and  less  than  0.1  man-years  were  require.?  tb 
run  the  programmes  at  BA  over  the  19  mth  period.  This  very  low  level  of  effort  is 
largely  due  to  the  effectiveness  of  the  Discrete  Gust  methods  and  the  care  spent  in 
defining  the  ways  of  presenting  the  analysed  data  before  specifying  the  software 
requirements.  Also,  a  preliminary  set  of  1200  landings  was  analysed  (Ref  4)  and  various 
improvements  to  the  analysis  procedures  introduced  before  proceeding  with  the  larger  data 
set.  The  main  change  being  the  introduction  of  ways  of  dealing  with  false  wind  shears 
resulting  from  heading  changes. 

Landings  have  been  recorded  at  over  70  airports  around  the  world  and  Fig  3  shows 
the  locations  of  airports  where  more  than  25  landing  records  have  been  collected. 
Details  of  the  numbers  of  records  at  each  airport  are  given  in  Table  2.  London 
(Heathrow)  as  the  hub  of  the  BA  network  has  26.4%  of  the  landings,  10  other  airports  have 
more  than  200  landings;  15  have  between  100  and  200  landings;  12  have  between  50  and  100 
landings;  13  have  between  25  and  50  landings  and  20  have  less  than  25  landings. 

Take-offs  have  not  been  analysed  because  the  time  spent  in  the  various  height  bands 
is  much  shorter  and  the  speed  variation  is  much  greater.  Thus  it  would  be  difficult  to 
obtain  a  controlled  data  set  for  statistical  analysis.  The  statistical  data  gathered 
from  landings  should  be  directly  relevant  to  take-off  cases  as  they  are  expressed  in 
terms  of  wind  changes  and  airborne  distances. 

3  LARGE  WIND  SHEAR 

Detailed  study  of  large  wind  shears  serves  several  purposes,  viz. 

a)  It  checks  that  they  are  not  the  result  of  corrupt  data  if  the  aircraft 
behaviour  is  consistent  with  the  shear.  This  is  particularly  important  if  the 
tails  of  the  distribution  are  to  be  extrapolated  to  obtain  Resign  cases; 

b)  it  confirms  that  the  Discrete  Gust  method  is  identifying  the  correct 
magnitude,  length  and  pattern  for  large  shears; 

c)  it  shows  the  relationship  between  downdraughts  and  the  various  forms  of 
headwind  shear  so  that  complete  shear  models  can  be  derived. 
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The  policy  of  identifying  significant  wind  shears  by  their  headwind  component  is 
based  on  the  fact  that  significant  downdraughts  cannot  exist  near  the  ground  without 
significant  horizontal  wind  components,  and  headwind  is  the  easiest  of  the  three 
components  to  identify  reliably.  There  is  no  implication  that  downdraughts  are  less 
significant  than  headwinds.  The  severity  of  a  wind  shear  will  depend  on  the  combined 
effects  of  both  components. 

86  Alerts  have  been  analysed  to  provide  three  component  wind  data.  Several  of 
these  are  used  in  this  section  to  illustrate  various  features  of  wind  shear.  To  complete 
the  picture  there  is  also  an  example  of  a  thunderstorm  downburst  recorded  on  the  RAE 
HS125  research  aircrft  during  the  Joint  Airport  Weather  Studies  (JAWS)  research  programme 
near  Denver,  Colorado,  USA  in  July  1982. 

3.1  San  Francisco,  August  1981 

San  Francisco  is  typical  of  many  airports  on  the  BA  B747  routes  in  being  close  to  a 
large  area  of  water.  In  this  situation  it  is  common  to  have  a  cool  on-shore  wind  during 
the  day.  Fig  4  shows  an  example  of  such  a  wind.  The  aircraft  (Fig  4a)  is  not 
significantly  affected  although  the  wind  increases  by  16  kt  in  16s.  It  is  interesting  to 
note  the  two  cool  layers  identified  by  the  temperature  time  history  in  Fig  4b,  with  a 
modest  low-level  jet  at  the  top  of  the  upper  layer  at  about  1500  ft  above  touchdown. 
This  'on-shore  wind*  type  of  shear  was  responsible  for  an  accident  to  a  DC10  at  Boston 
when  the  pilot  did  not  apply  thrust  early  enough  when  the  headwind  stopped  increasing. 
The  combination  of  decreasing  wind  and  increasing  temperature  with  height  can  cause  some 
problems  during  take-off  as  the  temperature  increase  reduces  thrust  at  the  same  time  as 
the  headwind  decreases.  This  can  also  coincide  with  the  reduction  of  thrust  for  noise 
abatement.  For  this  landing  the  temperature  at  2000  ft  is  nearly  8  deg  Celsius  warmer 
than  the  surface.  There  are  no  significant  updraughts  with  this  shear. 

3.2  Melbourne,  September  1981 

Melbourne  is  another  coastal  airport  and  the  wind  shear  recorded  in  September  1981 
did  cause  problems  (Fig  5a).  At  about  50s  from  touchdown  the  airspeed  fell  rapidly  by 
over  20  kt  and  the  rate  of  descent  almost  doubled.  Thrust  was  increased  almost 
immediately  to  a  level  just  greater  than  that  for  level  flight  and  the  airspeed  recovered 
about  half  of  the  loss  but  the  descent  rate  only  slowly  reduced  towards  the  normal 
approach  value.  The  aircraft  continued  to  descend  slowly  beneath  the  glide  path  until  at 
22s  to  touchdown  it  was  at  140  ft,  which  is  about  100  ft  below  the  glide  path.  At  this 
point  the  increased  thrust  suddenly  became  effective  and  the  aircraft  was  able  to  regain 
an  acceptable  flight  path  and  make  a  normal  landing.  The  problems  arose  from  a 
combination  of  headwind  and  downdraught  variations  (Fig  5b).  The  wind  at  1000  ft  was  33 
kt  from  about  50  deg  to  starboard.  At  600  ft  the  aircraft  entered  the  top  of  an 
inversion  with  a  downdraught  of  1200  ft/min,  a  wind  speed  loss  of  17  kt  and  direction 
changing  to  90  deg  to  starboard.  This  combination  of  speed  loss  and  direction  change 
results  in  a  change  in  headwind  component  of  29  kt  in  20s  (a  distance  of  1740  m),  which 
is  a  mean  rate  of  1.5  kt/s.  (NB  this  is  the  underlying  change  in  the  headwind  after 
filtering  most  of  the  shorter  transients  (turbulence).) 

At  the  moment  when  the  headwind  decrease  stops  there  is  another  large  downdraught 
of  nearly  900  ft/min  and  then  the  shears  cease.  It  is  at  this  point  that  the  aircraft 
starts  to  recover. 

3.3  Anchorage,  March  1981 

This  was  the  only  wind  shear  incident  reported  on  the  BA  B747  fleet  in  the  past  two 
years.  The  event  occurred  just  before  the  first  landing  at  Anchorage  recorded  for  the 
full  programme  and  is  not  included  in  the  statistical  data  set.  However,  a  full  data 
listing  was  obtained  and  processed  through  the  programme  that  calculates  the  three 
components  of  the  winds.  The  wind  shear  programme  with  BA  deliberately  did  not  include 
any  special  wind  shear  reporting,  as  it  is  sometimes  difficult  to  sort  out  wind  shear 
incidents  from  general  comments  on  less  significant  shears. 

On  the  first  approach  the  aircraft  encountered  severe  wind  shear  and  overshot. 
Wind  shear  was  still  present  9  minutes  later  during  the  second  approach  but  the  aircraft 
was  able  to  land  safely.  The  aircraft  behaviour  on  the  first  approach  is  shown  in  Fig  6a 
from  about  100s  (-120s  point  in  Fig  6a)  before  the  start  of  the  overshoot.  A  normal 
descent  was  started  at  -90s  but  an  excessive  sink  of  1800  ft/min  developed.  Thrust  was 
increased  at  -65s  and  restored  the  aircraft  almost  to  level  flight.  As  the  glide  path  is 
approached  the  thrust  is  again  reduced  (-50s).  Again  a  high  sink  rate  of  1600  ft/min 
developed  and  then  reduced  accompanied  by  an  airspeed  loss  of  22  kt.  At  -23s  the  descent 
rate  again  increased  to  1600  ft/min  and,  with  the  aircraft  about  500  ft  above  touchdown 
and  descending  well  below  the  glide  path,  full  thrust  was  applied  for  an  overshoot.  The 
Ground  Proximity  Warning  System  operated  a  couple  of  seconds  later  while  the  thrust, 
which  lags  behind  throttle  movement,  was  increasing  for  the  overshoot.  After  sinking  to 
a  minimum  height  of  420  ft  the  aircraft  climbs  away  safely. 

The  winds  and  temperature  (Fig  6b)  and  the  ground  track  with  wind  vectors  (Fig  6c) 
complete  the  history  of  this  event.  To  avoid  high  ground,  aircraft  on  the  approach  to 
runway  24  have  to  turn  about  90  deg  onto  the  extended  runway  centreline  about  4  nm  from 
touchdown.  The  aircraft  is  lined  up  on  the  centreline  at  -50s.  The  apparent  shear  in 
the  headwind  time  history  between  -80s  and  -50s  arises  from  the  heading  change  and  is 


entirely  false.  This  is  an  example  of  the  false  shears  that  can  arise  if  no  special 
analysis  method  is  used  to  account  for  heading  changes.  The  shears  between  -30s  and  -20s 
are  genuine  as  there  are  negligible  heading  changes.  The  very  large  shear  in  the  total 
wind  when  it  falls  by  35  kt  between  -55s  and  -40s  has  little  effect  on  the  aircraft 
because  the  change  is  almost  entirely  in  the  crosswind  component.  The  main  effects  on 
the  aircraft  come  from  updraughts  and  downdraughts  and  the  headwind  changes  at  about 
-30s.  It  is  interesting  that  the  updraught  at  -25s  is  of  warmer  air,  which  probably 
originated  in  the  warmer  layer  encountered  at  about  -60s  and  a  few  hundred  feet  higher. 
The  final  downdraught  which  led  to  the  overshoot  reached  1100  ft/min  and  lasted  about 
1  2s . 

3.4  Harare  (Zimbabwe),  August  1981 

The  aircraft  behaviour  (Fig  7a)  shows  two  large  thrust  applications  at  70s  and  30s 
before  touchdown  and  there  is  an  airspeed  increase  at  50s.  The  aircraft  sinks  below  the 
desired  flight  path  from  45s,  despite  a  thrust  increase,  and  then  recovers  at  20s. 

The  main  features  of  the  winds  and  downdraughts  (Fig  7b)  are  the  direction  change 
of  180  deg  between  42s  and  35s  and  a  prolonged  updraught  of  500  ft/min  at  about  70s 
followed  by  downdraughts  of  600  ft/min  at  48s  and  26s.  The  first  thrust  increase  is  used 
to  correct  a  low  airspeed  when  the  aircraft  is  low  on  the  flight  path.  Recovery  is 
assisted  by  the  updraught  and  thrust  is  rapidly  reduced.  Then  there  is  a  surge  in 
airspeed  at  the  same  time  as  the  first  downdraught  and  the  wind  direction  starts  to 
change.  The  loss  of  headwind  of  18  kt  in  12s,  which  starts  at  45s,  and  the  subsequent 
downdraught  at  26s  are  the  most  significant  wind  shears.  They  cause  the  aircraft  to  sink 
significantly  below  the  desired  flight  path.  The  airspeed  surge  at  50s  is 
counterbalanced  by  the  downdraught  and  has  little  effect  on  the  aircraft. 

The  air  temperature  has  a  peak  at  the  start  of  the  wind  direction  change  which 
shows  that  the  air  at  the  lower  heights  is  cooler.  This  and  the  very  large  change  in 
wind  direction  of  180  deg  are  the  sort  of  pattern  which  would  be  found  with  a  storm 
f  ront . 

3.5  Detroit,  April  1982 

The  aircraft  behaviour  (Fig  8a)  shows  a  particularly  disturbed  approach  with 
frequent  airspeed  variations  of  over  10  kt  and  descent  rate  varying  between  200  and  1000 
ft/min.  Then  at  28s  and  11s  there  are  two  dramatic  temporary  losses  of  airspeed, 
although  only  the  second  (and  less  dramatic)  results  in  any  significant  sink.  Thrust 
changes  are  few  except  at  the  two  airspeed  losses. 

Full  analysis  is  only  possible  from  113s  as  the  inertial  ground  speed  data  were 
lost  briefly  from  117s  to  114s.  This  wind  shear  is  an  example  of  one  which  is  not 
included  in  the  statistical  data  set  but  has  been  analysed  to  identify  large  wind  shears. 
Only  landings  where  120s  of  uncorrupted  data  are  available  have  been  used  for  the 
statistical  data  set.  No  air  temperature  data  are  available  for  this  landing  but  the 
winds  are  shown  in  Fig  8b.  The  wind  speed  of  50  kt  is  high  and  only  decays  a  little  from 
300  ft  down  to  touchdown. 

The  various  wind  components  overlap  on  Fig  8b  but  it  is  clear  that  most  of  the 
variations  in  descent  rate  from  120s  to  40s  are  caused  by  vertical  draughts.  The  first 
of  the  major  double  ramp  headwind  changes  at  28s  has  ramps  6s  (476  m)  long  and  an  average 
headwind  change  of  16.5  kt  (2.8  kt/s).  It  is  accompanied  by  an  updraught  of  900  ft/min 
and  it  is  this  which  alleviates  most  of  the  effects  of  the  airspeed  loss.  Indeed  the 
airspeed  changes  are  exaggerated  by  the  deliberate  speed  reduction  started  at  42s  and  an 
overshoot  in  speed  as  the  thrust  increase  in  response  to  the  sudden  airspeed  reduction 
during  the  wind  shear  takes  effect  at  the  same  time  as  the  wind  increases  again.  The 
minimum  airspeed  was  127  kt,  which  is  25  kt  below  the  average  airspeed  for  this  landing. 

The  second  airspeed  loss  at  11s  is  caused  by  another  double  ramp  headwind  variation 
with  8s  (634  m)  long  ramps  and  a  mean  speed  change  of  13.7  kt  (1.7  kt/s).  However,  this 
wind  shear  is  not  accompanied  by  any  significant  vertical  wind  changes  and  it  does  cause 
the  aircraft  to  sink  below  the  desired  flight  path.  The  airspeed  falls  to  135  kt  which 
is  17  kt  below  the  average  for  this  landing.  The  incidence  angle  of  the  aircraft,  which 
is  the  only  reliable  indication  of  its  proximity  to  stalling,  is  6  deg  higher  than  the 
normal  approach  value  during  this  second  shear.  During  the  first  shear  it  reaches  4  deg 
higher  than  normal  and,  thus,  the  aircraft  was  nearer  stalling  in  the  second  shear 
although  the  airspeed  was  8  kt  higher  than  during  the  first  shear.  This  illustrates  the 
fallacy  of  using  airspeed  as  a  measure  of  the  safety  margin  from  the  stall  in  highly 
dynamic  manoeuvering  situations  such  as  wind  shear  encounters.  Incidence  and  related 
measurements  such  as  those  from  stall  warning  sensors  are  the  only  relevant  indications. 
Pilots  should  make  maximum  use  of  the  lift  that  is  available  by  increasing  pitch  attitude 
if  necessary  and  never  attempt  to  lower  the  nose  to  gain  speed.  But  on  most  aircraft 
there  is  no  continuous  indication  of  the  margin  to  the  stall  in  dynamic  situations  such 
as  would  be  available  if  incidence  were  measured.  Thus  pilots  can  only  use  airspeed  as  a 
guide  and  will  always  be  tempted  to  use  every  available  means  to  regain  normal  approach 
speed  as  soon  as  possible.  Advice  such  as  flying  at  the  stall  warning  (stick  shaker  or 
natural  buffet)  cannot  be  applied  in  practice  because  the  pilot  has  no  information  on  his 
rate  of  approach  to  stall  warning,  of  his  margin  from  it,  or  degree  of  penetration  beyond 
it. 


The  wind  shears  of  this  example  also  indicate  the  importance  of  the  timing  of 
reversals,  which  is  the  reason  behind  the  inclusion  of  double  ramp  patterns  with 
different  time  intervals  between  the  ramps  in  the  patterns  identified  by  this  programme. 
In  this  landing  the  phasing  of  thrust  with  the  wind  shear  increases  both  the  maximum  and 
minimum  airspeeds  by  8-10  kt  compared  with  the  sizes  of  the  wind  shears. 

Disturbances  of  the  kind  seen  in  this  landing  at  heights  below  300  ft  and  in  strong 
winds  can  be  caused  by  the  wakes  of  large  buildings  on  or  near  the  airport.  There  are  no 
particular  warnings  in  the  landing  charts  for  Detroit  on  Runways  21L  or  21R,  but  if  this 
landing  was  on  21L  then  the  aircraft  would  be  in  the  lee  of  the  central  terminal 
buildings  at  the  place  where  the  large  shears  were  encountered.  It  is  not  possible  to 
differentiate  between  runways  with  the  same  heading  from  the  records  as  only  the  runway 
heading  is  known. 

3.6  Muscat,  June  1982 

There  is  a  tendency  to  worry  most  about  wind  shears  that  cause  a  loss  of  height 
because  the  consequences  of  landing  short  of  the  runway  are  often  catastrophic.  But  it 
is  possible  to  cause  major  damage  by  landing  too  far  along  the  runway  and  overrunning  the 
end  even  if  the  major:  y  of  the  passengers  escape  without  injury.  This  wind  shear  at 
Muscat  on  the  Gulf  of  Oman  in  the  Middle  East  demonstrates  a  type  of  wind  shear  which 
could  cause  an  overrun  accident  although  in  this  case  there  was  sufficient  runway 
available  for  a  safe  landing.  The  aircraft  (Fig  9a)  made  a  steady  approach  and  starts 
the  landing  flare  at  20s  and  should  have  landed  at  about  15s.  Instead  the  aircraft 
floats  for  about  1  km  (13s)  even  though  the  thrust  has  been  reduced  to  idle. 

The  winds  (Fig  9b)  show  that,  although  the  wind  speed  did  not  vary  significantly, 
the  wind  direction  swung  through  about  150  deg  to  a  tailwind  between  38s  and  14s  and  then 
back  through  170  deg  to  a  headwind  as  the  aircraft  flared  for  landing.  The  whole  event 
is  a  wind  shear  with  a  double  ramp  pattern  with  a  16s  (1210  m)  ramp  length,  an  interval 
of  16s  and  a  mean  wind  change  of  13.3  kt.  The  headwind  increase  that  causes  the  float  is 
part  of  this  double  ramp  and  has  a  13  kt  increase  in  12s  (1.1  kt/s).  This  just  about 
balances  the  normal  deceleration  in  airspeed  after  reducing  thrust  for  touchdown. 

3.7  Chicago  (O'Hare),  April  1982 

Just  as  a  rapid  increase  in  headwind  during  the  landing  flare  can  cause  a  long 
float,  so  a  rapid  decrease  can  be  one  of  the  causes  of  a  heavy  landing.  In  this  landing 
at  Chicago  the  aircraft  (Fig  10a)  made  a  reasonably  steady  approach  with  few  thrust 
changes  except  to  correct  the  low  airspeed  at  30s.  At  8s  the  airspeed  starts  to  drop 
rapidly  and,  by  the  time  the  thrust  reduction  for  the  landing  flare  starts,  it  has  fallen 
about  12  kt.  It  should  be  remembered  that  the  thrust  lags  the  pilots  throttle  movement. 
The  consequence  of  the  loss  of  airspeed  is  that  the  descent  rate  does  not  reduce  during 
the  flare  as  it  normally  would  (see  the  Detroit  landing,  Fig  8a).  The  rate  of  descent  at 
touchdown  on  this  Chicago  landing  was  10  ft/s  and  this  gave  a  vertical  acceleration 
increment  of  0.56  g.  This  is  a  hard,  but  not  quite  a  heavy,  landing. 

The  winds  (Fig  10b)  varied  quite  a  bit  during  the  early  part  of  the  approach,  but 
were  fairly  steady  from  50s  until  5s.  At  5s  the  wind  drops  by  13  kt  in  4s  (3.3  kt/s). 
At  this  point  the  aircraft  is  about  70  ft  above  the  ground  and  starting  the  landing  flare 
and  it  is  too  late  for  any  thrust  increase  to  take  effect  before  the  aircraft  lands.  In 
any  case  there  is  not  sufficient  excess  thrust  available  to  provide  3.3  kt/s  acceleration 
when  the  aircraft  is  in  the  landing  configuration  with  flaps  and  undercarriage  down. 

Several  other  hard  landings  as  a  result  of  a  wind  shear  during  the  flare  have  been 
seen  among  the  B747  data,  but  it  is  not  the  only  cause  of  hard  landings. 

3.8  Anchorage,  November  1981 

It  has  been  suggested  that  a  large  difference  of,  say,  25  kt  between  the  headwind 
during  an  approach  and  that  quoted  for  touchdown  can  be  used  as  a  warning  of  potentially 
serious  wind  shear.  Of  the  examples  presented  in  this  section  only  the  wind  shear  during 
the  landing  at  Harare  (Fig  7b)  would  be  identified  by  this  criterion  at  the  start  of  the 
approach,  and  the  shear  at  Melbourne  (Fig  5b)  would  be  identified  in  time  to  warn  the 
pilot.  The  other  shears  would  not  be  identified. 

There  are  also  quite  a  few  occasions,  such  as  this  landing  at  Anchorage  (Figs  11a 
and  b)  where  a  strong  headwind  at  the  start  of  an  approach  decays  quite  steadily  to  a 
light  wind  at  touchdown.  In  this  case  from  40  kt  at  65s  (about  800  ft  above  touchdown) 
to  5  kt  at  15s  (about  100  ft  above  touchdown).  This  decrease  of  0.7  kt/s  is  easily 
countered  by  a  moderate  thrust  increase  once  the  decreasing  headwind  is  recognized.  The 
approach  is  generally  uneventful  apart  from  the  effects  of  the  vertical  winds  between  40s 
and  30s. 

The  headwind  change  criterion  is  still  useful  but  it  should  be  noted  that  it  will 
not  identify  all  large  wind  shears  and  it  will  identify  quite  a  few  fairly  innocuous 
shears.  It  can  do  little  more  than  warn  a  pilot  that  there  is  a  possibility  of 
encountering  a  large  shear. 


3.9  London  (Heathrow),  April  1982 


The  final  example  chosen  from  the  BA  B747  records  is  rather  unusual.  It  shows  (Fig 
12a)  an  uneventful  approach  with  a  sudden  spike  in  airspeed  at  10s  and  a  small  spike  on 
the  pressure  altitude  at  the  same  time.  The  winds  in  Fig  12b  show  vertical  wind  and  wind 
direction  changes  as  well  as  a  horizontal  wind  spike  of  11  kt  at  10s.  All  these  wind 
changes  and  the  brief  reduction  in  static  pressure  shown  on  the  pressure  altitude  time 
history  are  characteristic  of  an  encounter  with  a  vortex  from  a  previous  aircraft.  This 
is  quite  likely  in  the  light  winds  with  a  small  crosswind  component  and  final 
confirmation  comes  from  the  roll  attitude  time  history  (not  shown  in  Fig  12)  which  shows 
that  the  aircraft  rolls  nearly  10  deg  to  starboard  at  10s. 

3.10  Thunderstorm  Downburst  Near  Denver,  July  1982 

Although  the  majority  of  the  data  in  this  paper  are  fron  BA  B747  flight  records, 
there  is  no  obvious  example  of  the  particularly  hazardous  dowr.bursts  associated  with 
thunderstorm  activity.  As  stated  in  Section  3,  the  RAE  HS125  research  aircraft  joined 
with  several  aircraft  from  research  agencies  in  the  United  States  of  America  and  a 
comprehensive  array  of  ground  based  equipment  in  the  Joint  Airport  Weather  Studies  (JAWS) 
Project  (Ref  5)  at  Denver,  Colorado  in  the  Summer  of  1982.  the  object  of  the  programme 
was  to  study  large  wind  shears  of  various  kinds  that  are  associated  with  thunderstorm 
activity.  These  vary  from  general  flow  circulations  around  the  storm,  such  as  storm 
fronts,  to  very  localized  events,  such  as  downbursts  and  tornados.  Analysis  of  the  data 
from  a  large  number  of  events  is  proceeding  in  the  USA  and  at  the  RAE  in  the  United 
Kingdom. 

An  example  of  a  time  history  of  a  penetration  of  a  downburst  (or,  because  it  is 
less  than  4  km  across,  a  microburst)  is  shown  in  Fig  13.  The  penetration  was  made  at  a 
height  of  about  1000  ft  above  ground  (Denver  is  over  5000  ft  above  sea  level)  and  at  a 
safe  speed  of  about  210  kt  CAS.  The  microburst  is  about  2.4  km  across  and  the  maximum 
headwind  change  is  -35  kt  in  5.3s  (640  m).  The  downdraught  fluctuates  considerably  and 
requires  a  mean  change  of  +3  deg  in  pitch  attitude  to  maintain  the  flight  path.  This 
corresponds  to  a  mean  downdraught  of  about  1200  ft/min  which  lasts  for  about  5s,  or  a 
distance  of  about  600  m.  The  fluctuations  in  downdraught  produced  +/-  l'g'  excursions  in 
normal  acceleration  at  the  flight  speed  of  210  kt  CAS,  which  would  be  reduced  to  about 
+/-  0.6  'g'  at  normal  approach  speeds. 

These  microbursts  occurred  quite  frequently  in  the  vicinity  of  thunderstorms  in  the 
Denver  area  and  could  be  associated  with  rain  or  only  virga  (light  rain  which  evaporates 
before  reaching  the  ground).  They  usually  built  up  and  then  decayed  within  5  to  15  min 
and  as  one  died  another  would  often  occur  a  few  kilometers  aways.  The  'dry'  microbursts 
under  virga  could  be  seen  quite  clearly  in  the  countryside  around  Denver  by  the  curtain 
of  dust  rising  to  over  1000  ft  around  the  perimeter  at  a  time  when  the  winds  outside  the 
microburst  were  light.  This  curtain  cf  dust  must  be  carried  on  a  strong  updraught  and 
this  is  not  compatible  with  the  model  of  downbursts  as  a  vertical  jet.  A  vertical  jet 
impinging  on  the  ground  will  produce  a  strong  outflow  with  only  weak  buoyancy  forces  to 
produce  any  updraught.  Thus  the  dust  should  blow  out  from  the  centre  as  an  almost 
horizontal  sheet.  Following  the  observations  of  the  JAWS  programme  it  has  been  suggested 
by  Caracena  at  a  Wind  Shear  Mini-Workshop  at  the  University  of  Tennessee  Space  Institute 
in  October  1982  and  by  Fujita  (Ref  6)  in  evidence  to  the  enquiry  into  the  New  Orleans 
accident  (Ref  1)  that  microbusts  are  the  flow  around  a  horizontal  vortex  ring.  This 
explains  the  dust  curtains  and  the  way  the  energetic  flow  velocities  are  contained  within 
such  a  small  area.  It  would  also  produce  strong  downdraughts  close  to  the  ground  and 
require  less  energy  than  a  jet  with  a  similar  downdraught.  The  data  of  Fig  13  would 
correspond  best  to  a  model  wit'i  several  vortex  rings  being  produced  one  after  the  other 
(Fig  14)  and  the  HS125  passing  between  two  rings.  The  lower  vortex  would  produce  the 
loss  of  headwind  at  36s  and  the  increase  at  54s  and  the  upper  vortex  would  cause  the  main 
headwind  changes  as  the  aircraft  appears  to  have  passed  closer  to  the  core  of  the  upper 
vortex  ring. 

It  seems  that  the  raicroburst  could  be  caused  by  localized  pulsation  in  or  just 
below  the  cloud.  The  suggestion  that  the  energy  changes  needed  to  produce  a  microburst 
comes  from  the  evaporation  of  cloud  moisture  is  supported  by  the  light  patch  visible  in 
the  cloud  after  a  microburst  decays. 

Although  microbursts  are  quite  common,  their  short  duration  and  small  size  mean 
that  the  probability  of  an  aircraft  encountering  one  at  its  peak  strength  on  approach  or 
take-off  at  an  airport  is  rare,  but,  as  several  major  accidents  show,  not  insignificant. 
These  same  characteristics  also  mean  that  any  ground  based  equipment  that  is  going  to 
detect  the  growth  of  a  microburst  should  scan  the  complete  area  in  less  than  about  3  min 
and  should  have  a  separation  between  measuring  points  which  is  not  more  than  about  1  km. 

4  WIND  SHEAR  STATISTICS 

The  statistics  from  9135  landings  represent  over  a  million  seconds,  or  over  300 
hours  of  records  covering  an  airborne  distance  of  about  83000  km  which  is  more  than  twice 
round  the  world.  They  have  been  used  to  identify  both  the  differences  between  various 
groupings  of  the  data,  eg  airports  and  height  bands,  and  also  the  overall  characteristics 
of  the  distribution  of  the  data  so  that  extrapolation  to  design  cases  can  be  made  with  an 
acceptable  level  of  confidence.  The  main  reasons  for  collecting  such  a  large  data  sample 
are  to  have  sufficient  examples  of  large  wind  shears  to  establish 
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a)  that  they  are  part  of  the  general  distribution  of  all  wind  shears  both  large 

and  small/  and  not  part  of  a  different  distribution  of  large  shears; 

b)  the  form  of  the  distribution,  which  is  not  expected  to  be  Gaussian.  About 

100000  data  points  are  required  to  define  the  distribution  of  the  tail  with 

reasonable  confidence. 

Ideally  more  data  would  be  desirable,  but  to  increase  it  by  a  further  factor  of  10 
would  require  20  years  of  analysis  at  the  present  rate.  As  the  distributions  contain 
over  150  large  wind  shears  and  are  well  defined,  the  statistical  analysis  has  been 
completed.  Analysis  of  large  events  will  however  continue  at  the  CAA  and  BA  as  part  of 
the  CAADRP  programme. 

4.1  Presentation  of  Data 

Wind  shears  are  identified  with  the  patterns  shown  in  Fig  1  and  the  measured  values 
of  headwind  change.  Basic  ramp  lengths  were  chosen  in  octave  bands  about  the  nominal 
values  for  4,  8  and  16s  (approximately  300,  600  and  1200  m).  This  means  that  data  for 
nominal  ramp  lengths  of  300,  600  and  1200  m  covers  ramps  in  the  ranges  200-400  m,  400-800 
m  and  800-1600  m  respectively.  To  simplify  the  interpretation  of  the  data  and  its 
application  to  ramp  patterns  of  a  particular  length  it  is  very  desirable  to  find  a  way  of 
normalizing  the  data  so  that  it  collapses  onto  a  single  curve  for  all  ramp  lengths.  One 
way  of  nomalizing  the  ramp  pattern  data  is  that  used  by  J  G  Jones  (Ref  3)  for  turbulence 
data.  The  number  of  shears  is  divided  by  the  total  number  of  ramp  lengths  travelled  and 
the  'speed  change'  divided  by  (ramp  length)l/3.  Strictly  the  (ramp  len^th)l/3  factor 
should  only  collapse  the  data  for  ramp  lengths  less  than  the  scale  length  as  it  relates 
to  the  region  of  the  power  spectrum  of  atmospheric  turbulence  with  a  slope  of  -5/3. 
Scale  length  is  defined  as  the  longest  wavelength  where  the  slope  of  the  power  spectrum 
is  -5/3.  Wind  shears  have  long  wavelengths  which  may  be  greater  than  the  scale  length. 
However,  it  was  decided  to  use  the  same  normalization  process  for  wind  shear  data  to 
provide  a  convenient  basis  for  comparison  with  turbulence  data  and  because  it  may  prove 
adequate  for  normalizing  much  of  the  data. 

The  effect  of  using  this  normalizing  method  on  data  for  single  ramps  with 
decreasing  winds  from  244  landings  at  New  York  (JFK)  are  shown  in  Fig  15.  The  data  are 
presented  as  cumulative  distributions  for  three  nominal  ramp  lengths  of  299,  599  and  1198 
m.  In  a  typical  cumulative  distribution  the  number  of  occurrences  where  the  headwind 
change  exceeds  a  given  level  are  divided  by  the  total  time  of  the  sample  and  plotted 
against  the  headwind  change  value,  ie  it  is  the  integral  of  the  frequency  distribution 
from  that  headwind  value  to  infinity  with  positive  and  negative  speed  changes  considered 
separately.  In  Fig  15,  for  example,  there  are  0.1  exceedances  of  -7  kt  (ie  more  negative 
than  -  7  kt)  per  minute,  which  means  one  would  expect  to  encounter  a  headwind  decrease  of 
more  than  7  kt  about  once  in  every  10  min  on  the  approach  to  JFK.  At  JFK  the  normalizing 
factors  are  very  effective  in  collapsing  data  for  the  three  ramp  lengths  onto  a  single 
curve.  This  is  found  to  be  the  case  for  quite  a  lot  of  airports.  The  divergence  at  the 
tails  is  because  there  are  insufficient  events  to  establish  the  curves  with  any 
confidence . 

All  the  data  in  this  section  (Section  4)  are  presented  in  this  normalized  form  of 
cumulative  distributions  (’exceedances').  On  many  of  the  figures  the  shear  pattern  and 
nominal  ramp  length  are  shown  by  a  small  diagram  of  speed  against  distance  similar  to 
those  in  Fig  1. 

In  the  following  sections  it  will  be  necessary  to  cross  refer  to  various  figures 
and  the  normal  process  of  numbering  figures  sequentially  at  their  first  appearance  will 
not  produce  a  logical  sequence  of  figures  for  the  reader  who  is  not  studying  the  complete 
text.  Thus  the  figures  are  presented  in  the  sequence  most  appropriate  to  the  order  of 
the  sections. 

4.2  Overall  Probabilities 

This  section  takes  all  the  data  from  all  airports  and  looks  at  the  probabilities  of 
a  BA  B747  encountering  particular  wind  shears  during  normal  operations.  Because  of  the 
wide  range  of  airports  served,  these  probabi 1 i t ies  may  well  be  representative  of  those 
for  other  airlines  on  worldwide  routes.  They  are  not  necessarily  representative  of  the 
probabilities  for  local  routes  such  as  those  within  Europe  or  mainland  USA.  However, 
data  on  probabilities  of  encounter  at  individual  airports  (see  Section  4.3)  will  be 
relevant  to  those  situations. 

Three  main  aspects  of  the  overall  statistics  are  considered  in  this  paper.  They 


a)  different  ramp  lengths; 

b)  different  ramp  patterns,  and 

c)  different  height  bands. 

4.2.1.  Single  ramp  patterns  of  different  lengths 


Cumulative  distributions  of  single  ramps  with  nominal  lengths  of  305,  609  and  1218 
m  are  shown  in  Fig  16.  The  609  m  and  1218  m  data  collapse  well  onto  a  common  line  but 


there  are  more  305  m  ramps  than  would  be  needed  for  such  a  collapse.  This  is  shown  later 
(Fig  24)  to  be  a  situation  that  is  peculiar  to  certain  airports  and,  as  these  include 
London  (LHR)  which  has  26%  of  all  the  landings,  the  separate  line  for  305ra  ramps  is  only 
going  to  be  relevant  for  route  systems  whose  hub  airport  has  this  characteristic.  There 
are  several  airports  with  this  characteristic  (Section  4.3.2.31  but  London  shows  it  most 
strongly.  Thus  it  is  likely  that  the  305  m  ramps  will  show  the  same  tendency  for  other 
worldwide  route  structures,  but  perhaps  less  marked  than  in  these  data. 

The  most  important  features  of  Fig  16  are  the  linearity  of  the  cumulative 
distributions  at  large  wind  shear  values.  This  will  provide  a  good  basis  for 
extrapolation  of  the  results  to  define  suitable  values  for  design  cases.  The  deviations 
from  linearity  at  the  lowest  probabilities  are  not  significant.  They  represent  a  few 
isolated  events  and  thus  their  true  probability  of  occurring  is  not  known. 

The  collapse  of  the  data  with  ramp  length  is  similar  for  all  ramp  patterns  and  for 
most  of  the  data  in  the  next  few  sections  only  that  at  a  nominal  ramp  length  of  about  600 
m  is  presented. 

The  slight  spread  of  exceedances  at  the  origin  for  increasing  headwinds  is  due  to 
the  mean  gradient  of  headwind  with  height  and  is  considered  in  more  detail  in  Section 
4.2.3. 

4.2.2  Different  shear  patterns  with  a  nominal  length  of  600  m 

Fig  17  shows  cumulative  probability  curves  for  all  four  shear  patterns  at  a  nominal 
ramp  length  of  609  m  for  all  landings.  The  speed  change  scale  can  be  presented  on  this 
figure  as  only  one  ramp  length  is  considered.  One  of  the  main  features  is  the  very  small 
difference  in  probability  between  all  three  types  of  double  ramp  shears.  As  may  be 
expected,  the  double  ramp  with  an  interval  of  one  ramp  length  between  the  shears  is 
slightly  less  likely  at  a  given  shear  size  but  the  differences  are  small.  The  other  main 
feature  is  the  almost  constant  ratio  between  the  speed  changes  for  single  ramps  and  those 
for  double  ramps  at  a  given  number  of  exceedances  per  ramp  length.  The  ratios  are 
approximately  0.74  for  decreasing  speeds  and  0.82  for  increasing  speeds.  The  differences 
between  speeds  increasing  and  decreasing  are  largely  due  to  the  biasing  effects  of  the 
average  rate  of  change  and  curvature  of  wind  speed  with  height  which  is  discussed  further 
in  the  next  section  (Section  4.2.3.) 

With  this  well  defined  relationship  between  all  the  double  shear  patterns  and 
single  ramp  shears  it  is  possible  to  describe  characteristics  of  all  these  shear  patterns 
for  the  overall  route  network  by  studying  the  trends  in  single  ramp  shears.  However,  in 
some  instances,  such  as  studying  the  character  of  shears  at  individual  airports,  it  is 
wise  to  consider  the  simple  double  ramp  pattern  as  well  as  single  ramps  in  case  there  is 
variation  in  the  relationship  because  of  some  local  features  at  particular  airports. 

4.2.3  Different  height  bands 

Fig  18  shows  the  cumulative  probabilities  for  single  ramps  with  a  nominal  length  of 
608  m  separated  into  four  nominal  height  bands.  The  separation  is  actually  into  time 
bands  but,  as  most  of  the  landings  follow  a  glide  path  angle  of  about  3  deg  the  time 
bands  can  be  converted  directly  into  heights.  The  bands  are  0-250,  250-500,  500-1000  and 
1000-1500  ft.  Zero  is  taken  as  the  height  indicated  at  touchdown,  which  is  about  40  ft 
above  ground  level  for  the  B747.  There  are  no  significant  changes  in  the  slopes  of  the 
data  in  Fig  18  in  different  height  bands  or  between  increasing  or  decreasing  speed 
changes.  There  are,  however,  shifts  in  the  intercepts  at  zero  speed  change,  ie  the  total 
number  of  shears.  Speed  reductions  become  more  probable  in  the  lower  height  bands.  This 
effect  is  seen  more  clearly  in  Fig  19  where  data  for  all  three  ramp  lengths  is  compared 
for  the  lowest  two  height  bands.  The  difference  in  'speed  change'  between  the  increasing 
and  decreasing  ramps  at  a  given  level  of  exceedances  is  due  largely  to  the  mean  rate  of 
change  of  headwind  with  height  (the  wind  gradient).  Because  of  the  descending  flight 
path  the  total  probability  distribution,  which  includes  both  positive  and  negative  'speed 
changes',  will  have  a  mean  which  is  nearly  equal  to  the  gradient  of  the  'mean  headwind' 
with  height  multiplied  by  the  change  of  height  in  travelling  one  ramp  length.  Thus  the 
difference  between  'speed  changes'  at  a  constant  cumulative  probability  will  be  twice  the 
change  of  'mean  headwind'  in  travelling  one  ramp  length.  The  inset  table  on  Fig  19  gives 
the  expected  gradient  of  'mean  headwind'  in  the  two  lowest  height  bands  derived  from  data 
at  different  ramp  lengths.  The  values  agree  with  each  other  but  are  slightly  larger  than 
those  on  the  variation  of  the  'mean  headwind’  with  height  (Fig  20)  (NB:  The  height  in  Fig 
20  is  taken  as  40  ft  at  touchdown  to  give  height  above  ground  rather  than  height  above 
touchdown.  This  is  to  allow  the  data  to  be  compared  with  standard  profiles  of  wind 
against  height).  Integrating  the  gradients  derived  from  the  cumulative  probability  data 
gives  a  total  speed  change  over  1500  ft  height  of  8.2  kt,  cf  an  actual  change  of  6.9  kt. 
The  difference  is  due  to  a  small  skew  in  the  data  between  increasing  and  decreasing 
speeds.  This  is  shown  in  Fig  19  by  the  slightly  more  negative  slope  of  the  decreasing 
ramps . 

Thus  the  only  significant  effect  of  height  on  wind  shear  is  this  bias  due  to  the 
gradient  of  the  mean  wind  with  height.  The  bias  is  quite  significant  in  the  last  200  ft. 
One  important  consequence  of  this  finding  is  that  it  is  possible  to  construct  probability 
distributions  appropriate  to  take-off  cases  simply  by  applying  biases  from  the  data  of 
Fig  20  in  the  reverse  sense  to  the  landing  cases  analysed  here.  In  the  take-off  cases 
the  bias  will  be  positive  and,  because  of  the  steeper  climb  gradient,  slightly  larger. 


I  1-10 


This  will  make  speed  decreases  of  any  given  size  less  likely  during  take-off  than  during 
landing. 

Again  although  there  is  no  particular  variation  in  probabilities  of  encounter  with 
height  other  than  the  bias  for  the  overall  data,  there  may  be  particular  features  at 
individual  airports.  The  data  for  San  Francisco  (Fig  22),  which  will  be  discussed  in 
Section  4. 3. 2.1,  shows  more  headwind  increases  at  height  between  250  and  500  ft  than  in 
other  bands.  These  correspond  to  the  'on-shore'  winds  such  as  that  in  Fig  4.  A  similar 
peculiarity  is  apparent  in  300  m  increasing  double  ramps  at  Hong  Kong  (Fig  23a)  which 
correspond  to  the  spike  shown  in  Fig  23b  (Fig  6  of  Ref  4). 

A  corollary  of  this  effect  of  height  is  that  wind  shears  at  a  constant  height  above 
the  ground  would  be  independent  of  that  height.  At  first  glance  this  conflicts  with 
results  from  turbulence  measurements  close  to  the  ground  (Ref  8).  However,  when  flying 
over  undulating  terrain,  the  height  above  ground  is  not  constant  and,  in  increasing  and 
decreasing  about  the  mean  height  above  ground,  both  positive  and  negative  shears  will  be 
added  to  the  distribution.  The  size  of  these  additional  shears  will  be  greater  close  to 
the  ground  and  increase  with  increasing  variations  in  terrain  height.  However,  over  flat 
terrain  there  should  be  no  effect  of  altitude.  Another  difference  between 
landings  (and  take-offs)  and  general  flight  at  low  altitude  is  the  bias  of  the  flight 
direction  into  wind  for  landings.  Finally,  turbulence  data  has,  so  far,  only  been 
presented  for  individual  flights  in  particular  conditions  and  not  for  an  accumulation  of 
conditions  as  with  the  wind  shear  data.  Thus,  it  is  not  surprising  that  there  are  some 
apparent  differences.  It  will  be  interesting  to  see  if  further  analysis  supports  the 
conclusions  of  this  wind  shear  data. 

4.3  Airport  Characteristics 

The  distribution  of  wind  shears  at  individual  airports  can  be  influenced  by  a  wide 
variety  of  features  such  as  local  topography,  season,  wind  direction,  time  of  day, nearby 
large  areas  of  water,  airport  buildings,  etc.  With  a  limited  sample  of  data  it  is  not 
possible  to  study  all  these  effects  and  in  the  examples  presented  here  the  data  are  for 
the  2  years  of  the  study  and  all  runways,  except  at  Hong  Kong  where  the  50  deg  heading 
change  on  the  approach  to  Runway  13  prevented  any  analysis  and  only  data  for  approaches 
to  the  other  end  of  the  single  runway  (Runway  31)  are  available.  The  times  of  day  are 
usually  restricted  to  a  narrow  band  defined  by  the  timetable  for  the  route  and  the  range 
of  landing  times  is  given  in  Table  2. 

Data  has  been  collected  in  groups  of  50  landings  at  each  airport  (100  landings  at 
London  ( LHR ) )  so  that  some  indication  of  seasonal  variations  could  be  otained  at  the  most 
frequently  visited  airports.  Aircraft  heading  after  touchdown  is  available  to  help 
identify  the  runway  in  use,  but  with  the  limited  sample  size  it  is  not  possible  to  obtain 
much  useful  information  on  the  characteristics  of  the  approaches  to  individual  runways, 
except  when  studying  any  large  events. 

4.3.1  Differences  between  airports 

Fig  21  shows  the  distribution  of  negative  single  ramp  and  positive  double  ramp 
shears  of  600  m  at  8  airports.  At  any  level  of  exceedance  the  airport  with  the  largest 
wind  shears  has  speed  changes  of  no  more  than  about  twice  that  of  the  airport  with  the 
smallest  shears.  The  lowest  shear  levels  among  these  airports  were  at  Nairobi  (NBO) , 
Kuala  Lumpur  (KUL)  and  Singapore  (SIN).  Landings  at  NBO  are  mainly  just  after  sunrise 
when  weather  activity  is  often  at  it  quietest.  KUL  and  SIN  on  the  other  hand  have 
landings  during  the  late  afternoon  and  are  also  renowned  for  their  levels  of  thunderstorm 
activity  during  the  summer. 

The  largest  shear  levels  were  at  Hong  Kong  (HKG,  RW  31  only).  New  York  (JFK)  and 
London  (LHR)  for  single  ramps  and  Hong  Kong  (HKG  RW  31  only)  for  double  ramps.  Hong  Kong 
is  surrounded  by  rugged  mountainous  terrain  and  is  well  known  for  the  high  level  of 
turbulence  on  the  approach.  Only  approaches  to  Runway  31  could  be  analysed  because  of 
the  offset  Instrument  Landing  System  and  the  late  heading  change  of  50  deg  required  for 
landings  on  Runway  13.  In  general  the  shape  of  the  distributions  are  well  established, 
even  with  only  just  over  100  landings  at  an  airport.  The  large  event  in  the  distribution 
for  double  ramps  at  San  Francisco  (SFO)  is  expected  to  become  part  of  the  general  pattern 
if  a  larger  sample  is  taken. 

Thus,  as  the  hub  airport,  LHR,  is  one  of  the  airports  with  large  wind  shears  and  as 
the  overall  selection  of  airports  is  representative  of  a  wide  variety  of  conditions 
around  the  world,  the  overall  distributions  of  Section  4.2  are  believed  to  be 
representative  of  most  international  route  systems. 

4.3.2.  Individual  airport  characteristics 

From  the  distribution  of  wind  shears  in  different  height  bands  and  patterns  it  is 
often  possible  to  identify  the  major  characteristics  of  wind  shears  at  individual 
airports. 


4. 3. 2.1.  San  Francisco  (SFO) 

In  Fig  22  the  single  ramp  distributions  show  that  the  level  of  positive  single 
ramps  between  heights  of  250  and  500  ft  are  nearly  twice  as  large  as  those  at  other 
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heights.  The  difference  between  positive  and  negative  ramps  in  this  height  band  shows 
that  the  mean  wind  increases  with  decreasing  height  instead  of  decreasing  as  it  usually 
does.  This  behaviour  is  caused  by  the  frequent  on-shore  winds  of  the  type  shown  in  Fig 
4.  Double  ramps  show  no  unusual  features  other  than  the  very  large  single  event  with  an 
average  speed  change  of  17  kt.  As  with  all  statistical  samples,  any  large  event  can 
occur  at  any  time  and  will  only  find  its  true  probability  level  if  the  sample  is  very 
large.  Thus  single  large  events  will  often  be  displaced  from  the  true  probability 
distribution  in  this  way. 

4. 3. 2. 2.  Hong  Kong  ( HKG ) ,  Runway  31  only 

The  approach  to  runway  31  at  Hong  Kong  Airport  is  over  the  sea  and  passes  between 
Hong  Kong  island  and  the  mainland;  both  of  which  are  mountainous  regions.  This  approach, 
is  often  very  turbulent,  as  indeed  is  the  other  approach  to  runway  13,  which  could  not  be 
analysed  because  of  the  50  degree  turn  shortly  before  touchdown.  The  distribution  of 
wind  shear.  Fig  23(a)  shows  slightly  larger  levels  of  single  ramp  shears  than,  at  San 
Francisco.  However,  the  double  ramp  shears  of  305  m,  which  are  nearest  to  turbulence, 
have  a  magnitude  almost  twice  that  of  the  San  Francisco  double  ramp  shears.  Fig  23(b) 
shows  an  example,  from  Ref  4,  of  turbulence  at  Hong  Kong.  The  large  double  ramp  of  4 
second  ramp  length  (c  300  m)  is  fairly  common  in  westerly  winds,  but  does  not  produce 
such  a  distinction  shift  as  the  on-shore  winds  at  San  Francisco,  Fig  22. 

4. 3. 2. 3.  London  ( LHR) 

In  Fig  24  the  data  for  negative  single  ramps  of  301,  602  and  1203  m  in  the  four 
height  bands  shows  a  reasonable  collapse  of  the  distributions  of  the  two  longer  ramps  but 
larger  levels  of  speed  changes  for  the  301  m  data.  This  effect  was  noted  in  the 
preliminary  data  of  Ref  4  where  it  was  speculated  that  it  could  be  caused  by  higher 
levels  of  turbulence  from  nearby  buildings.  A  similar  effect  was  noted  in  Johannesburg 
(JNB)  and  Los  Angeles  (LAX)  and  is  still  noticeable  in  the  present  data.  However,  the 
presence  of  the  larger  levels  of  speed  changes  at  301  m  in  all  the  height  bands  is 
surprising  as  one  might  expect  building  turbulence  to  be  more  prominent  in.  .the  lower 
height  bands.  The  data  suggest  that  (ramp  length)  rather  than  (ramp  length)1'3  will  be 
needed  to  collapse  the  data  at  different  lengths.  This  could  imply  that  the  scale  length 
of  turbulence  is  significantly  shorter  at  these  airports  than  it  is  at  many  others. 

However,  whatever  the  cause,  the  consequence  is  that  these  airports  will  pose  more 
of  a  wind  shear  problem  to  aircraft  with  low  approach  speeds,  which  are  more  sensitive  to 
the  shorter  length  shears,  than  to  faster  jet  transport  aircraft,  which  will  mainly 
notice  more  turbulence. 

4. 3. 2. 4.  Kuala  Lumpur  (KUL) 

In  contrast  to  the  previous  section  the  data  for  Kuala  Lumpur  in  Fig  25  shows  no 
unusual  features  and  an  excellent  collapse  of  data  at  all  ramp  lengths. 

5  WIND  SHEAR  SEVERITY 

Various  attempts  have  been  made  to  define  a  wind  shear  severity  scale  to  relate 
wind  speed  changes  and  rates  of  change  to  the  potential  hazard  to  aircraft.  One  such 
scale  was  proposed  to  the  International  Civil  Aviation  Organization  (ICAO)  and  suggested 
that  the  changes  of  wind  in  600  m  horizontal  distance  or  30  m  vertically  should  be  used 
to  define  severity  for  headwind  changes.  Table  3  gives  details  of  the  proposals 
presented  to  ICAO.  In  practice  aircraft  are  going  to  be  affected  by  two  main  factors. 
First  by  the  rate  of  change  of  wind  speed  in  relation  to  the  acceleration  that  can  be 
achieved  with  the  excess  thrust  available,  which  is  typically  about  3  kt/s  for  a  jet 
transport  aircraft  in  the  approach  configuration.  Second  by  the  total  magnitude  of  that 
wind  speed  change  especially  relative  to  the  speed  margin  from  the  level  flight  stalling 
speed,  which  is  the  lowest  speed  at  which  level  flight  can  be  maintained  and  is  typically 
about  20%  (or  about  25  kt  for  a  jet  transport  aircraft).  In  general  wind  shear  will  only 
be  a  problem  if  both  these  values  are  significant.  This  can  be  seen  if  one  considers  two 
extremes.  In  one  case  it  is  clear  that  an  aircraft  can  easily  respond  to  even  a  100  kt 
change  of  wind  if  the  rate  of  change  is  only  0.1  kt/s,  and  similarly  for  a  case  at  the 
other  extreme  with  only  a  5  kt  change,  even  a  rate  of  change  of  10  kt/s  is  no  problem. 
The  use  of  a  fixed  distance  in  association  with  total  wind  changes  restricts  the 
description  of  wind  shears.  For  example,  the  shear  at  Melbourne  (Fig  5)  is  only  12  kt 
over  600  m  yet  it  is  the  total  change  of  29  kt  that  is  significant.  If  the  shear  had 
only  lasted  for  600  m  then  the  total  flight  path  deviation  would  have  been  much  less. 

Other  problems  in  defining  simple  wind  shear  severity  scales  are  the  different 
responses  to  single  ramps  and  double  ramps.  With  double  ramps  the  wind  eventually 
returns  to  nearly  the  initial  value  and  thus  aircraft  throttle  action  is  less  critical 
and  even  unneccessary  for  short  ramp  lengths.  With  single  ramps  some  throttle  action  is 
essential  to  stabilize  at  the  new  condition. 

However,  it  is  very  desirable  to  give  some  guidance  on  wind  shear  severity  to  help 
pilots,  meteorological  forecasters  and  aircraft  and  avionic  equipment  designers  in  their 
judgement  of  wind  shear.  The  data  obtained  from  the  BA  flight  records  give  an 
opportunity  to  try  and  suggest  a  broad  guide  to  wind  shear  severity,  at  least  for  single 
ramp  shears.  If  the  rate  of  change  of  headwind  and  the  ratio  of  its  total  change  to  the 
aircraft's  normal  approach  speed  are  taken  as  the  main  factors  and  the  total  change  is 
more  significant  than  rate  of  change,  then  a  severity  factor  could  be 
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S  *  (dv/dt). [del  V/Vappl^  =  [  del  V/(Ramp  length  )  V  Vapp 

where  S  =  wind  shear  severity  factor 

dV/dt  =  rate  of  change  of  wind  speed 

del  V  =  total  change  of  wind 

Vapp  =  normal  approach  speed 

Thus,  the  primary  parameter  turns  out  to  be  the  normalized  wind  shear  value, 
[  del  V/(Ramp  length)l/3],  used  in  all  the  statistical  data  figures. 

The  relationships  between  the  severity  factor,  S  and  ramp  length,  dv/dt  and 
(del  V  /  Vapp)  are  shown  in  Fig  26a.  Further  consideration  of  aircraft  response  suggests 
that  when  the  rate  of  change  of  wind  speed  is  greater  than  the  acceleration  available  by 
applying  full  thrust  then  it  will  be  the  total  change  of  wind  that  dominates  the  response 
of  the  aircraft,  and  conversely  when  the  rate  of  change  is  low  then  the  total  change  will 
not  be  significant.  This  suggests  that  at  (dv/dt)  >  1.5  m/s2),  which  is  about  the 
maximum  available  on  transport  aircraft  in  the  approach  configuration,  the  lines  of  egual 
severity  will  tend  to  become  parallel  to  the  lines  of  constant  (del  V/Vapp)  and  at  the 
right  hand  side  of  the  figure  the  lines  of  equal  severity  will  be  parallel  to  the  lines 
of  constant  (dV/dt).  Between  these  two  regions  it  may  not  be  unreasonable  to  have  lines 
of  constant  severity  at  constant  values  of  the  severity  factor,  ie  horizontal. 
Suggestions  for  possible  boundaries  are  shown  in  Fig  26b,  where  the  categories  of  light 
to  severe  are  the  same  level  of  aircraft  response  used  in  Table  3. 

The  boundaries  have  been  based  on  the  BA  B747  measurements  and  Fig  26c  shows  these 
with  wind  shear  and  ramp  length  scales  for  a  B747  together  with  those  points  for  the 
large  wind  shears  of  Figs  4-12  where  a  single  ramp  headwind  variation  was  a  significant 
factor.  As  well  as  relating  the  severity  parameter  to  these,  a  line  giving  the  level  of 
wind  shear  expected  once  in  10'  for  the  B747  scales  is  included.  This  suggests  that  the 
probability  of  a  B747  meeting  a  severe  shear  in  headwind  on  the  British  Airways  routes  is 
about  2  in  10”  landings.  It  should  be  remembered  that  this  does  not  include  the 
probability  of  encountering  a  severe  downdraught.  Aircraft  with  lower  approach  speeds 
will  be  more  likely  to  encounter  severe  wind  shears  if  the  criteria  of  Fig  26  are 
relevant. 

As  the  values  of  the  normalized  wind  shear  are  constant  for  a  wide  range  of  ramp 
lengths  from  about  400  m  to  2000  m,  it  is  possible  to  produce  a  simplified  severity  scale 
and  this  is  shown  in  Fig  27  with  the  mean  cumulative  B747  data.  Also  shovn  is  the  scale 
proposed  to  ICAO  and  it  can  be  seen  that  that  such  a  scale  would  have  expected  a 
probability  of  encountering  severe  shears  of  about  1  in  700  landings,  or  about  13 
hazardous  events  in  the  sample  of  over  9000  landings  from  BA  B747’s.  At  most  only  one 
such  event  (Fig  5)  was  found  and  that  was  on  the  borderline  between  ’strong1  and 
’severe’.  (NB  the  overshoot  event  of  Fig  6  was  caused  by  downdraughts  and  is  not  covered 
by  this  headwind  criterion.)  Thus  it  is  clear  that  the  scale  proposed  to  ICAO  was  not 
relevant  to  B747  operations  and  does  not  take  sufficient  account  of  the  wide  range  of 
ramp  lengths  that  are  significant  to  particular  aircraft. 

However,  it  must  be  emphasized  that  the  scales  of  Fig  26  are  only  intended  as  a 
guide  and  relate  primarily  to  approach  conditions.  During  take-off  the  climb  angle 
represents  an  acceleration  capability  even  though  there  is  no  additional  thrust  available 
from  the  engines,  other  than  the  use  of  any  emergency  ratings,  thus  the  criteria  of  Fig 
26  may  still  be  relevant  with  the  climb  speed  used  instead  of  Vapp.  In  the  climb  the 
speed  margin  from  the  stall  is  usually  slightly  smaller  but  the  probability  of 
encountering  headwind  reductions  is  less  because  of  the  favourable  gradient  of  mean 
headwind  when  climbing. 

Any  severity  scale  must  be  tested  in  piloted  flight  simulators  and  stand  the  test 
when  applied  to  real  flight  situations. 

6  COMMENTS  ON  WIND  SHEAR  DESIGN  CASE  SIMULATION 

One  of  the  main  aims  of  this  programme  has  been  to  provide  data  from  which 
realistic  design  cases  can  be  chosen  to  test  aircraft  control  and  display  systems,  and 
detection  and  control/display  systems  designed  to  respond  to  wind  shear.  The  choice  of 
the  levels  of  probability  of  encounter  is  a  matter  for  certificating  authorisation  and 
will  not  be  addressed  in  this  report.  This  section  demonstrates  how  the  data  may  be  used 
to  obtain  design  cases  and  comments  on  the  relevant  levels  of  turbulence  which  must  be 
added  to  the  wind  shear.  Some  adequate  representation  of  turbulence  is  essential  because 
of  the  difficult  compromise  needed  between  fast  and  false  responses.  It  is  recommended 
that  a  turbulence  model  based  on  Discrete  Gust  methods,  such  as  that  of  Ref  8,  should  be 
used,  as  it  has  a  realistic  form  with  more  larger  and  fewer  moderate  inputs  than  those 
models  based  on  white  noise. 

6.1  Using  Discrete  Gust  Data  for  Design  Cases 

To  demonstrate  the  application  of  the  statistical  data  gathered  from  the  Discrete 
Gust  analysis  methods  consider  the  answers  to  two  typical  questions: 
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a)  What  are  the  largest  speed  decreases  and  their  corresponding  negative  rates  of 
change  that  are  likely  to  be  encountered  once  in  1000  landings  worldwide? 

b)  At  San  Francisco,  how  frequently  are  on-shore  winds  with  a  wind  change  of  +20 
kt  at  +3  kt/100  m  likely  to  be  encountered? 

For  the  first  question  the  initial  step  is  to  convert  1000  landings  into  the  number 
of  ramp  lengths  travelled.  The  average  distance  travelled  in  120s  before  touchdown  at  an 
average  true  airspeed  of  76  m/s  is  9.12  Km.  Thus  the  number  of  ramp  lengths  in  1000 

landing  records  is  1000*  (9120/(Ramp  Length)),  where  (Ramp  Length)  is  the  nominal  value 
at  the  centre  of  the  octave  band  of  (Ramp  Length)  represented  by  a  single  line  on 

cumulative  probability  plots.  Fig  16  gives  data  for  single  ramps  for  the  worldwide 
sample  and  Table  4  lists  the  answers  to  the  question  for  ramps  from  200  m,  where  the 

(Speed  change)  is  -11.8  kt  at  -5.9  kt/100  m,  up  to  1600  m,  where  the  (speed  change)  is 

-17.7  kt  at  -1.1  kt/100  m.  Ramp  characteristics  where  the  octave  bands  meet  are  not 
identical,  although  the  differences  are  small  when  the  lines  on  the  normalized  cumulative 
distribution  collapse  to  a  single  line  for  different  nominal  ramp  lengths.  When  they  do 
not  collapse  then  a  plot  of  equi-probable  ramp  characteristics  can  be  derived  by 
smoothing  the  normalized  data. 

The  single  ramp  cases  for  the  rarer  probability  of  1  in  10,000,000  landings  are 
shown  on  Fig  26(c).  The  1  in  1000  cases  approximately  correspond  to  the  boundary 
between  'Moderate'  and  'Strong'  for  B747  on  the  scale  suggested  in  Fig  26. 

In  discussing  a  possible  severity  scale  in  Section  5  the  need  to  consider  both  the 
(speed  change)  and  the  gradient  was  established  and  the  answer  to  question  a)  shows  that 
there  is  a  range  of  different  ramps  that  are  equally  probable.  Thus  any  design  cases 
must  cover  the  range  of  ramps  that  are  relevant.  This  may  be  possible  for  single  ramps 
by  testing  three  cases  of  equi-probable  shears. 

a)  a  shear  with  a  gradient  greater  than  the  acceleration  capability  of  the 
aircraft, 

b)  a  shear  with  (Speed  change)  about  the  same  as  the  initial  speed  margin  from 
stall, 

c)  a  shear  between  the  two  above. 

These  shears  should  be  chosen  from  the  range  of  equi-probable  shears  for  the  normal 
landing  and  take-off  speeds,  and  also  acceleration  potential  of  the  aircraft  (or  class  of 
aircraft)  being  considered. 

The  second  question  about  San  Francisco  on-shore  winds  describes  a,  shear  of  +20  kt 
in  a  ramp  length  of  667  m,  which  is  normalized  shear  of  +1.18  (m/s  )/(m1//'J)  .  Fig  22  show 
data  for  San  Francisco  and  the  on-shore  winds  are  in  the  octave  with  a  nominal  ramp 
length  of  594  m  and  the  higher  band  from  250  to  500  ft.  Extrapolating  •■he  main  trend  of 
the  line  gives  a  probability  of  2.4/10000  per  ramp  length  travelled  ior  a  normalized 
shear  of  +1.18  (m/s)/(m  ).  Between  250  and  500  ft  there  are  2.5  shear  lengths  for  each 

landing  and  thus  this  type  of  shear  (or  any  of  the  other  shears  corresponding  to  the  same 
normalized  value)  could  be  encountered  once  in  1700  landings.  It  should  be  remembered 
that  this  probability  applies  to  landings  at  the  normal  scheduled  landing  time  for  BA 
B747  flights  to  San  Francisco,  which  is  1545  local  time. 

Statistically  it  is  not  meaningful  to  ask  for  the  probability  of  occurrence  of  a 

specific  ramp  but  only  of  ramps  within  a  band  of  characteristics.  Thus  the  probability 

of  shears  with  a  particular  normalized  value  can  be  determined,  but  the  probability  of  a 
specific  ramp  is  infinitesimal. 

6.2  Turbulence  for  Design  Cases 

Having  said  that  adequate  representation  of  turbulence  is  important  for  design  wind 
shear  cases  it  is  necessary  to  define  some  relationship  between  these  two  contributions 
to  the  total  winds.  One  simple  approach  would  be  to  have  the  standard  deviation  of  the 
turbulence  proportional  to  the  instantaneous  total  wind,  ie  wind  shear  plus  any  general 
wind.  The  general  level  of  fluctuations  in  wind  speed  in  the  individual  wind  shear 

examples  of  Figs  4  to  12  tends  to  support  this  suggestion  in  many  cases.  A  standard 

deviation  of  horizontal  turbulence  of  about  10%  of  the  total  wind  is  a  reasonable  level. 
However,  there  are  two  significant  cases  where  this  simple  approach  is  not  adequate,  viz: 

a)  topographic  turbulence,  which  is  related  to  local  terrain  variations  as 
well  as  wind  velocity, 

b)  thunderstorm  downburst  where  the  fluctuations  in  the  downdraught  are 
nearly  as  large  as  the  mean  downdraught. 

Data  for  Anchorage  and  Hong  Kong  suggest  that  topographical  turbulence  can  have  a 
standard  deviation  of  about  20%  of  the  total  wind  for  horizontal  turbulence. 

The  normal  'g '  fluctuations  of  Fig  13  suggest  that  the  standard  deviation  of  the 
downdraught  speed  is  about  50%  of  the  mean  downdraught.  This  figure  is  supported  by 
unpublished  data  of  a  thunderstorm  downburst  encounter  on  take-off  from  Chicago. 
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Generally  vertical  turbulence  will  be  less  than  horizontal  turbulence  near  the 
ground  and  reduce  as  the  height  decreases.  However,  for  many  cases  it  may  be  adequate  to 
keep  vertical  turbulence  at  about  2/3  of  horizontal  turbulence,  which  is  typical  for  a 
few  hundred  feet  above  ground  (see  MIL-F-8785C,  Fig  11).  A  decrease  in  vertical 
turbulence  with  height  for  thunderstorm  downdraught  cases  will  be  generated  automatically 
as  the  downdraught  decreases  near  the  ground. 

Generating  the  progression  of  turbulence  in  all  three  axes  for  a  path  through  a 
thunderstorm  downburst  requires  knowledge  of  the  location  of  the  downburst.  This  is  best 
identified  by  the  presence  of  vertical  wind  (updraught  or  downdraught).  It  is  then 
possible  to  set  turbulence  as  a  basic  level  depending  on  horizontal  wind  which  applies 
both  within  and  outside  the  downburst,  plus  additional  turbulence  related  to  the 
downdraught  (or  updraught).  This  will  give  the  very  high  levels  of  turbulence 
experienced  in  downbursts. 

Table  5  summarises  the  suggested  levels  of  turbulence  for  various  shear  cases.  No 
attempt  has  been  made  to  simulate  the  more  subtle  variations  of  turbulence  with  height, 
wind  direction,  temperature  gradient,  etc.  The  aim  is  to  provide  turbulence  that  is 
sufficiently  representative  of  actual  operations  to  test  the  effectiveness  of  systems 
that  react  to  or  detect  wind  shear.  More  subtle  descriptions  of  turbulence  are  probably 
unnecessary,  although  if  they  are  already  available  in  a  simulation  then  they  can  be 
used . 


It  is,  however,  important  that  the  turbulence  simulation  has  the  intermittency  and 
distribution  of  gusts  found  in  the  real  atmosphere.  This  is  best  achieved  using  the 
Discrete  Gust  model  of  Ref  8  which  has  been  validated  in  normal  simulations. 

7  FURTHER  WORK 

The  data  from  the  BA  B747  landings  are  sufficient  to  define  suitable  realistic 
design  cases  for  wind  shear.  However,  although  the  worldwide  coverage  is  extensive,  it 
is  very  desirable  to  obtain  further  data  from  other  sources  to  confirm  the  levels  of 
probability  and  obtain  detailed  information  on  other  airports  and/or  landing  times.  To 
do  this  the  data  must  be  analysed  by  the  Discrete  Gust  method.  The  Dutch  National 
Aeronautical  Laboratory  ( NLR )  are  planning  to  use  the  Discrete  Gust  methods  on  about  8000 
landings  already  stored  on  their  computer  (Ref  9).  When  this  is  completed  then  the  RAE 
and  NLR  will  exchange  data.  Any  data  from  other  sources  can  be  added  to  this  data  base 
if  it  is  analysed  by  the  same  method. 

Another  essential  activity  to  validate  design  cases  is  to  continue  analysing  large 
wind  shear  incidents  and  this  will  be  done  by  including  large  wind  shears  in  the  UK  Civil 
Aircraft  Airworthiness  Data  Recording  Programme  (CAADRP)  together  with  information  on  the 
total  number  of  landings  searched.  This  same  data  will  also  provide  a  basis  for 
confirming  severity  scales  by  relating  the  severity  of  the  shear  to  the  aircraft  height 
loss  and  pilots'  reaction.  Again,  it  would  be  extremely  valuable  if  other  agencies 
and/or  airlines  could  provide  data  analysed  in  the  same  way. 
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A) 


RECORDED  DATA 


Parameter 

Resolution 

Samples/sec 

Comments 

Run  Data 

Airport 

- 

- 

Runway  Heading 

1  deg 

- 

Magnet ic 

Touchdown  Weight 

0.1  tonne 

- 

Recorded  Data 

Groundspeed 

0.1  kt 

1 

Calibrated  Air  Speed 

0.1  kt 

1 

Pressure  Altitude 

1  ft 

1 

Total  Air  Temperature 

0.1  deg  C 

0.5 

Windspeed 

1  kt 

0.25 

JINS  smoothed 

Wind  Direction 

1  deg 

0.25 

loutputs  used 
)for  verifies 
Jpurposes 

Pitch  Attitude 

0.1  deg 

4 

Roll  Attitude 

0. 1  deg 

2 

Heading 

0.1  deg 

1 

Magnetic 

Normal  Acceleration 

0.001  g 

8 

Lateral  Acceleration 

0.001  g 

4 

Longitudinal  Acceleration 

0.001  g 

1 

No  2  Engine  Pressure  Ratio 

0.001 

1 

No  3  Engine  Pressure  Ratio 

0.001 

1 

Spare 

ILS  Glide  Slope 

0.1  mV 

1 

ILS  Localizer  1 

0.1  mV 

1 

ILS  Localizer  2 

0.  1  mV 

1 

ILS  Localizer  3 

0.1  mV 

1 

Flap  Angle 

1  deg 

1 

Discrete  Data 

Autopilot  A  Engaged 

- 

1 

Autopilot  B  Engaged 

- 

1 

Autopilot  C  Engaged 

1 

Localizer  1  Captured 

- 

1 

Localizer  2  Captured 

- 

1 

Localizer  3  Captured 

- 

1 

Autothrottle  Engaged 

-  - 

1 

ILS  Deviation  Warning 

- 

1 

NB:  Data  is  provided  from  125  seconds  before  touchdown  to  10  seconds  after  it. 


B)  CALCULATED  DATA 

All  results  at  one  per  second  from  123  seconds  before  touchdown  through  to 
touchdown . 

Wind:  Horizontal  speed  ( k t ) 

Horizontal  direction  from  runway  (deg) 

Vertical  speed  (ft/min) 

Static  Air  Temperature  (deg  C) 

Pressure  height  above  touchdown  (ft) 

Pressure  change  at  constant  height  (mb) 

Inertial  vertical  velocity  (ft/s) 

Sideslip  angle  (deg) 

Incidence  angle  (deg)  (NB:  No  incidence  record  available) 

Drift  angle  (deg) 

Engine  pressure  ratio  (No  2) 


TABLE  1.  ALERT  DATA  INPUTS  AND  OUTPUTS  ( WSALE ) 
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■ 

Airport 

T 

-  -  | 
Approx  Scheduled  BA  B747  Landi ngs ( March  1982) 

■ 

1 

J 

Total 

j 

Code 

Name 

; 

Weekly 

Local  Time  (No  per  Week)  | 

LHR 

1 

London ( Heathrow )  | 

2413 

C.120 

All  day  | 

NBO 

Nairobi  ] 

602 

14 

0800(71,2330(7)  | 

BOM 

Bombay  j 

447 

22 

0030 (3), 02 30 (5), 0435(2), 0615(3),  0900  (2),  | 

1305(1), 1510(1), 1615(1), 22 30(1), 2355(1)  ( 

SYD 

Sydney  | 

281 

20 

06 15(6), 0740(7), 1555(2), 1600  (5)  | 

SIN 

Singapore  1 

266 

18 

1505(1), 1735(7), 1820(4), 2110(4), 2250(1),  | 

2340(1)  | 

JFK 

New  York ( JFK )  j 

244 

7 

1335(7)  | 

AUH 

Abu  Dhabi  i 

243 

12 

0110(1), 0125(2), 0205(1), 04 00(2), 0440(1),  | 

0455 (  2) ,  0645(  1  ) ,  2 330 (  2  )  | 

JNB 

Johannesburg  I 

242 

16 

07 35(1),  0805(2), 0840(1), 1005(4), 10 20(1),  | 

1150(7)  | 

BOS 

Boston  | 

220 

7 

1340(3), 1420(4)  | 

BAH 

Bahrain  | 

212 

9 

00 50 (2), 0220(1), 02 50(1), 0315(2), 03 30(1),  | 

0620(1), 2300(1)  | 

SFO 

San  Francisco  | 

211 

7 

1545(7)  | 

KUL 

Kuala  Lumpur  j 

187 

8 

0025(1), 1620 (2), 16 50  (2), 2325(3)  | 

SEA 

Seattle  ! 

184 

3 

1255(3)  | 

PER 

Perth  j 

182 

8 

0020(2), 1840(1), 2130(2), 2325(  3)  | 

MEL 

Melbourne  | 

181 

16 

07  00( 2) ,  09  00( 4) ,  1000( 1 ) ,  1 0  20  (  7) ,  1  9  20  (  2)  | 

I  AD 

Washington  DC(IAD)  | 

178 

7 

1445(4), 1615(3)  | 

LAX 

Los  Angeles  | 

171 

5 

1525(5)  | 

FCO 

Rome  (FCO)  j 

167 

4 

0525(1), 0605(1), 1250(1), 1920(1)  | 

MCT 

Muscat  | 

165 

7 

0320(1), 04 10(2), 04 30(1), 0520(1),  06 15(1),  | 

0710(1)  | 

YYZ 

Toronto  | 

157 

9 

1545(2), 16)0(1), 17 30 (4), 1735(2)  | 

NRT 

Tokyo  (NRT)  | 

146 

12 

14 50 (4), 1545(2), 1720(2), 19 30(1), 20 30  (3)  | 

BGI 

Barbados  | 

139 

7 

154 0(1), 1725(1), 1735(2), 2045(1), 2230(2)  ( 

HKG 

Hong  Kong  I 

137 

12 

1015(1), 1110(1), 1115(2), 1505(3), 1640(1),  ( 

1945(31,2045(1)  | 

ANC 

Anchorage  j 

127 

8 

0855(4), 1110(4)  | 

YMX 

Montreal  j 

125 

6 

1340(2) ,1535(4)  | 

MIA 

Miami  | 

103 

7 

1730(7)  | 

PIK 

Prestwick  i 

97 

1 

0710(1)  | 

SAY 

Harare  | 

91 

2 

0540(2)  | 

ORD 

Chicago  (O'Hare)  j 

81 

5 

1645(5)  | 

DTW 

Detroit  | 

74 

4 

1635(4)  | 

PHL 

Philadelphia  | 

72 

3 

1630(3)  | 

AKL 

Aukland  j 

66 

7 

0735(  1) ,0745(4),  1315(2)  | 

CMB 

Colombo  | 

65 

4 

08 50(1), 1635(1), 1815(1), 2115(1)  | 

MAN 

Manchester  | 

63 

1 

0720(1)  | 

OSA 

Osaka  | 

61 

7 

1645(1), 1705(3), 2015(3)  | 

ecu 

Calcutta  i 

5  J 

2 

0950(11,2235(1)  | 

POS 

Port  of  Spain  j 

58 

3 

1735(11,1930(2)  | 

MNL 

Manila  j 

57 

2 

1420(2)  ( 

ZRH 

Zurich  | 

42 

2 

0535(1), 1430(1)  | 

SEZ 

Seychelles  | 

40 

4 

0340(1), 0545(1), 1910(1), 1945(1)  | 

BKK 

Bangkok  i 

37 

4 

00 10(1), 14 30(1), 1435(1), 1440(1)  | 

HLP 

Jakarta  | 

36 

1 

1055(1)  | 

LGW 

London  (Gatwick)  | 

34 

0 

| 

DXB 

Dubai  | 

33 

0 

BWN 

Brunei  | 

32 

2 

1855(11,2110(1)  | 

_ _ _ 1 

TABLE  2.  SUMMARY  OF  LANDINGS  AND  SCHEDULED  TIMES 


■ 

Airport 

Total 

Visits 

Approx  Scheduled  BA  B747  Landings (March  1982) 

Code 

Name 

Weekly 

Local  Time  (No  per  Week) 

STN 

Stansted 

31 

0 

PEK 

Peking 

30 

2 

1355(1), 1405(1) 

DUR 

Durban 

28 

2 

0855(1) , 1305(1) 

ANU 

Antigua 

26 

4 

1525(1), 1620(1), 2115(1), 2155(1) 

YVR 

Vancouver 

26 

2 

1710(1), 1730(1) 

BNE 

Brisbane 

25 

2 

0800(2) 

DHA 

Dhahran 

24 

1 

2155(1) 

YYC 

Calgary 

22 

1 

1620(  1 ) 

SNN 

Shannon 

21 

0 

UVF 

Saint  Lucia 

16 

1 

1815(1) 

MRU 

Mauritius 

15 

1 

0915(1) 

YEG 

Edmonton 

11 

1 

1600(1  ) 

KWI 

Kuwait 

5 

4 

1920(2),  2100(1),  2125(1  ) 

FRA 

Frankfurt 

4 

0 

BHX 

Birmingham 

3 

0 

JED 

Jeddah 

3 

0 

COG 

Paris  (CDG) 

3 

0 

ATH 

Athens 

3 

0 

DEL 

Delhi 

3 

10 

0330(2),  111  5(1),  1220(  1),  1325(1  ), 2  340(5) 

EDI 

Edinburgh 

2 

0 

AMM 

Amman 

2 

0 

BRU 

Brusse Is 

1 

0 

PMX 

Palma 

1 

0 

LCA 

Larnaca 

1 

0 

MBA 

Mombasa 

1 

0 

LPL 

Liverpool 

1 

0 

1 

Total|  9136 

1 

TABLE  2  (Contd) 
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Intensity 
of  Shear 

Effect  on 

Aircraft  Control 

Head  Wind 
Shear  in  600  m* 

1 

1 

1 

Light 

Little 

0  to  2  m/s  (0  to  3.9 

| 

kn )  | 

Moderate 

Significant 

2  to  4  m/s  (4  to  7.8 

kn )  j 

Strong 

Considerable  difficulty 

4  to  6  m/s  (7.9  to  11 

.7  kn)  | 

Severe 

Hazardous 

>6  m/s  (11.7  kn ) 

_ 

1 

_ 1 

•Described  separately  as  change  for  600  m  horizontally  and  30  m  in 
height,  but  this  is  equivalent  to  600  m 
travelled  on  a  3*  flightpath 


WINDSHEAR  SEVERITY  SCALE  PROPOSALS  TO  ICAO 


Nominal 

Ramp  Length, 
m 

Ramp  Lengths 
for  1000 
Landings 

1 

(Speed  chanqe)  ] 

( Ramp  length ) 1/3  j 
(m/s)/m  !/3  j 

305 

30000 

-1.04  | 

1 

1 

609 

15000 

1 

1 

-0.85  | 

1 

1218 

7500 

_ 

1 

-0.78  | 

1 

_ 

Ramp  Length 
m 


Speed  Change 
kt 


Gradient 
kt/100  m 


TABLE  4. 


SINGLE  RAMPS  WIND  SHEARS  WITH  A  1  in  1000  LANDINGS  PROBABILITY. 
WORLDWIDE  DATA  (FIG  16) 


1 

1 

L 

Standard  Deviation 

of 

1 

1 

j 

Case  i 

1 

1 

T 

Headwind  | 

u  | 

r 

Crosswind  | 

v  | 

Downdraught 

w 

1 

I 

I 

j 

General  Wind  Shear  [ 

0.  IV  | 

0.  IV  | 

0.07V 

1 

I 

I 

Topographical  Wind  Shear  J 

1 

0.2V  | 

I 

0.2V  | 

0.13V 

1 

1 

I 

Thunderstorm  Downburst  ( 

Wind  Shear  ! 

_ L 

i 

(0.1V  +  0. 2D)  I 

1 

_ L 

i 

(0.1V  +  0. 2D)  I 

1 

_ L 

(0.07V  +  0.4D) 

i 

i 

l 

l 

V  =  Horizontal  Total  Wind  before  adding  turbulence 
D  =  Downdraught  in  thunderstorm  downburst  before  adding  turbulence 

NB:  Both  these  are  treated  as  positive  regardless  of  wind  direction. 


TABLE  5 


SUGGESTED  TURBULENCE  LEVELS  FOR  WIND  SHEAR  DESIGN  CASES 


Initial  time  history 


-  I  20. 


Winds  and  temperature 


Zimbabwe,  August  1981  Fig.  8  Windshear  at  Detroit,  April  196? 


.  .  .  .  .  ue-»->c  pwj.1  D.^  ,  Fi*.  14  Thunderstorm  downburst.  Vortex  ring  flow  model 

Fig.  13  Thunders tora  aicroburst  -  JAWS  Project,  RAE  HS125  -  Flight  792,  Run  3  6  c 
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Cumulative  distribution  of  single  ramps  (British  Airways  records) 


SHfcA* 


Oam&£, 

kt 


Fitf*  17 


Variation  of  shear  probability  with  pattern 


No  Of 

AtCfloCr  LAMb<*c,fc 


Fig«  ?A  Cumulative  distributions  of  single  and  double  600  m  ramps  at  a 
selection  of  airports 
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Variation  of  single  and  double  ramps  with  height 
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Fig,  A  London  (Heathrow).  Variation  of  single  rampr>  with  height 
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Fig.  ?5 


Kuala  Lumpur.  Variation  of  single  ramps  with  height 


a.  Variation  of  dV/dt  and  AV/V  with  severity  factor  and  (ramp  length)A 


b.  Suggested  form  of  severity  boundaries 
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c.  Severity  scales  for  874? 


Fig.  26  Possible  severity  scales  for  single  reap  headwind  changes 


a.  deverity  scale  suggested  at  ICAO  b.  Possible  simplified  severity  scale 


Fig.  27 


Simplified  severity  scales 
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1  INTRODUCTION  I  ederal  Republic  of  ( icrniany 

Tlind  shear  during  take-off  and  landing  may  crucially  restrict  flight  safety.  In  some  rare 
situations,  especially  during  take-off,  hazards  may  be  caused  by  limited  flight  performance. 

In  most  cases  wind  shear  accidents  and  incidents  result  from  the  fact  that  the  wind 
shear  phenomenon  is  not  understood  by  the  pilot  due  to  his  training  condition  and  the  cock¬ 
pit  instrumentation.  In  such  situations  the  pilot  is  not  able  to  act  in  the  correct  way. 

Therefore  it  can  be  suspected  that  a  considerable  amount  of  wind  shear  accidents  will 
be  interpreted  wrongly  as  pilot's  error. 

Numerous  investigations  have  been  made  in  order  to  solve  the  wind  shear  problem.  Many  of 
these  proposals  will  fail  because  the  physical  phenomena  are  not  understood  completely, 
neither  by  the  pilots  nor  by  the  investigators  of  the  wind  shear  warning  system.  This 
problem  will  be  illuminated  by  the  fact  that  some  of  the  correct  safety  procedures  in  wind 
shear  contradict  the  pilot's  feeling  of  how  to  control  an  aircraft. 

This  paper  tries  to  clarify  step  by  step  some  physical  backgrounds  of  the  wind  shear  pheno¬ 
mena  including  adequate  flight  safety  procedures  to  overcome  the  problems. 


2.  WIND  SHEAR  SCENARIO 

Wind  shear  is  an  alteration  of  horizontal  wind  with  time,  height  and  distance.  Concerning 
the  airplane  this  results  in  a  time  varying  wind  speed. 

Wind  shear  is  not  only  related  to  stormy  weather,  as  one  might  expect,  but  also  to  misty 
mornings  in  early  summer  as  well  as  to  bright  sunshine  in  periods  of  fair  weather  1!. 

In  most  cases  wind  shear  is  combined  with  up-  and  downdrafts. 

Wind  shear  as  a  great  variety  of  phenomena  may  be  characterized  by  two  extreme  situations: 

-  thunderstorm  with  immense  time  varying  effects,  high  turbulence  and  extreme  downdrafts; 
( f lq . 1  a  ) 

-  low  level  jet  lasting  for  hours,  no  turbulence,  less  wind  velocity  outside  the  jet 
( f  lq . lb) . 

Between  these  two  extremes  several  other  kinds  of  wind  shear  related  weather  phenomena 
have  been  observed. 

In  addition  flight  safety  may  be  reduced  by  wake  turbulence  caused  by  large  buildings  as 
well  as  by  orographic  lee  effects.  The  effect  of  surface  boundary  layer  is  always  per¬ 
sistent  7.  1 ,  (fig. 2).  Wake  turbulence  caused  by  large  buildings  (fig. 3)  can  reduce  flight 
safety  as  well  as  orographic  1 ee  effects  (fig. 4) 


Duo  to  geographic  c i rcums tances  and  the  thickness  of  the  shear  layer,  small  or  moderate 
wind  shear  gradients  can  be  more  dangerous  in  some  exceptional  situations  than  extreme 
thunderstorm  shears  31. 


3.  AIRCRAFT  RESPONSE  DCK  TO  W  i  XU  -SHEAR 


,e  time  varying  wind  changes  tirst  the  airspeed  of  an  aircraft  due  to  its  inertia.  As  a 
consequence  varying  aerodynamic  tones  accelerate  the  aircraft.  Due  to  the  static  stabili¬ 
ty  of  the  airplane  and  due  to  the  pilot's  behaviour  to  keep  the  airspeed  constant,  the 
aircraft  will  be  accelerated  by  the  varying  wind.  The  airspeed  deviation  is  amazingly 
small  (fig. 5).  The  largest  airspeed  deviation  is  caused  by  the  dynamic  response  of  the 
aircraft  outside  the  shear  layer  1 1.  The  more  important  flight  path  deviations  are  demon¬ 
strated  in  fig. 7  for  take-off  and  in  tig. 6  for  landing  approach. 

Investigations  on  energy  transfer  between  wind  and  aircraft  !  1 , 4 J  have  shown  that  energy 
based  on  inertia!  speed  and  height  is  fairly  constant  at  small  flight  path  angles.  This  is 
true  tor  all  transport  aircraft  in  normal  flight  regimes  (fig. 5).  Only  gilder  aircraft  can 
transfer  significant  energy  from  the  wind  in  extreme  flight  manoeuvers,  as  for  example  in 
dynamic  soaring  flight.  P.Krauspe  .5!  pointed  out  that  wind  shear  induced  by  flight  path 
deviations  can  be  approximated  by  simple  analytical  functions  (fig. 8).  A  fundamental 
result  ot  this  investigation  was  that  the  aircraft  response  in  wind  shear  is  to  a  great 
extent  independent  of  aircraft  charartrristics.  The  major  parameters  of  influence  are 
airspeed  and  lift  to  drag  ratio.  It  should  be  noted  that  the  earth-fixed  wind  shear  can 
extensively  modify  the  phugoid  stability  (fig. 9).  Krauspo's  numerical  calculations  have 
been  verified  in  a  moving  cockpit  simulation.  Fig. 10,  curve  1  shows  the  response  of  a 
wide  body  aircraft  flown  by  an  experienced  airline  pilot  in  a  reported  thunderstorm 
situation  that  caused  the  crash  of  a  Boeing  727  in  New  York  in  1975.  Fig. 10  delivers  two 
essential  answers: 

-  airspeed  deviation  is  negligibly  smal 1  even  under  adverse  weather  conditions  (,:10  kts) 

-  the  pilot  does  not  respond.  The  flight  path  is  very  similar  to  the  fixed  control  situa 
tion  in  fig. 8. 

Fig. 11  shows  the  response  of  the  same  aircraft  in  the  same  thunderstorm  and  downburst 
situation,  when  the  aircraft  is  controlled  by  a  less  experienced  airline  pilot  (1500 
flight  hours).  The  high  control  activity  is  typical  but  does  not  prevent  the  crash.  The 
airspeed  deviation  is  very  low,  too. 


TAKE-OFF 

The  influence  of  wind  shear  on  flight  safety  during  take-off  and  go  around  differs  very- 
much  from  the  situation  during  approach  and  landing.  Handling  qualities,  cockpit  instrumen 
tation  and  training  condition  of  the  pilot  are  essential  during  landinq  approach.  On  the 
other  hand  limited  flight  performance,  especially  in  a  "one  engine-  out”  situation  of  a 
twin-engined  aircraft  dominates  durinq  take-off,  qo  around  and  missed  approach.  The  typi¬ 
cal  response  of  an  aircraft  during  take-off  in  a  wind  shear  is  illustrated  in  fig. 7. 
Primarily  dangerous  is  the  strong  reduction  of  fliqht  path  angle.  The  crash  of  a  Continen¬ 
tal  Airlines  Hoeing  727  in  Denver,  Colorado  in  August  1975  in  a  thunderstorm  is  shown  in 
fig. 12  3, 91. Under  the  condition  of  a  decreasing  headwind  that  changed  to  an  increasing 

tailwind  coinciding  with  a  strong  downdraft,  the  aircraft  struck  the  ground  approxi¬ 
mately  1  nm  after  lift  off.  This  has  been  an  accident  that,  was  unavoidable  due  to  the 
severity  of  the  wind  shear  encounter  and  the  aircraft  performing  near  its  maximum  capabi- 


OROGRAPHIC  INFLUENCED  WIND  SHEAR 


Less-known  and  understood  is  the  potential  hazard  posed  by  low-velocity  downdrafts  and  wind 
shear  in  the  lee  of  a  large-surface  obstacle  (fig. 4).  The  influence  of  these  factors  has 
been  studied  at  a  German  airport  and  with  extensive  simulation.  The  results  of  these 
studies  follow. 

The  typical  wind  speed  is  given  as  Vw  =  10  kt  from  240°  (fig. 13).  On  the  basis  of  this 
relatively  low  wind  velocity,  the  wind  model  shown  in  figure  4  was  developed.  The  different 
wind  shear  profiles  result  from  the  variable  surface  "roughness"  of  the  area  -  (a  neutral 
stability  of  the  atmosphere  ..as  assumed).  At  higher  wind  speeds,  additional  eddies  will 
take  place  but,  with  the  present  simulation  model,  these  values  are  not  sufficiently 
accurate  110],  The  maximum  downdraft  velocity  at  a  median  west  wind  of  V,,  =  10  kt  is 
0.25  m/s. 


The  effect  of  orographic  induced  wind  shear  and  downdraft  is  especially  serious  during 
take-off  and  missed  approaches  at  airports,  where  the  take-off  and  landing  weight  is 
limited  du e  to  runway  length  and  obstacle  clearance.  This  influence  shall  be  demonstrated 
on  a  twin  engined  aircraft  with  an  engine  failure  at  the  critical  take-off  speed  V.  or  at 
the  decision  height. 

For  comparison,  fig. 14  shows  the  take-off  and  climb  paths  of  a  typical  twin-engined 
medium-haul  jet  aircraft  (A)  and  a  typical  twin-engined  short-haul  jet  aircraft  (B)  in  a 
case  where  second  segment  climb  is  hindered  by  an  obstacle  in  the  flight  path.  In  this 
case,  the  flight  path  determines  the  maximum  allowable  take-off  weight  or,  obst acle-1 lmi ted 
take-off  weight.  The  limited  allowable  take-off  weight  under  these  conditions  is  shown  as 
a  percentage  of  the  aircraft's  structural  weight.  Despite  the  different  take-off  weights 
and  engine  thrust  the  flight  paths  are  essentially  identical.  From  the  standpoint  of  flight 
nvchanics,  the  procedure  can  be  described  as  "standard". 

In  the  case  of  a  limited  take-off  weight  because  of  obstacles,  the  flight  path  is  directly 
affected  by  the  terrain  and  obstacles.  In  the1  case  of  a  go  around  or  a  missed  approach, 
however,  the  FAA  does  not  stipuiate  a  cor responding  consideration  of  the  terrain  under  the 
probable  flight  path.  The  rules  here,  assuming  an  engine  failure,  require  only  that  a 
minimum  climb  gradient  of  2,1%  be  maintained.  Nevertheless,  when  the  decision  for  a  go¬ 
-round  is  reached,  obstacle's  within  the  missed  approach  area  must  be  considered.  In  the 
event  of  an  approach  followed  by  a  go  around , where  the  engine  failure  occured  prior  to  the 
beginning  of  the  landing  approach  and  the  landing  flaps  have  been  set  accordingly,  it  is 
assumed  that  the  flight  path  always  will  be  over  areas  known  to  be  obstacle-free.  If  engine 
failure  occurs  at  decision  height  while  the  aircraft  is  in  a  normal,  both-engine  landing 
configuration,  it  can  (under  certain  circumstances)  fly  through  the  obs tael e-f ree  zone 
within  the  mi ssed-appr oach  area.  The  reason  for  the  latter  is  the  need  of  the  aircrew  to 
get  the  f 1 aps  from  the  "normal"  landing  position  to  the  configuration  for  an  engine-out 
balked  landing.  This  takes  time  and  has  the  effect  of  "stretching"  the  badly  needed  hori¬ 
zontal  flight  path  for  acceleration  to  a  safe  control  speed  or  risking  a  loss  of  altitude. 
Despite  identical  points  for  the  initiation  of  the  mi ssed-approach  procedure,  the  perfor¬ 
mance  characteristics  of  different  aircraft  result  in  different  flight  paths  as  shown  in 
tig. 15.  Low-per f ormance  aircraft  pose*  more  of  a  problem. 

This  problem  has  been  discussed  for  years  in  the  I n t erna t lona 1  Civil  Organization's  (ICAO) 
Airworthiness  Committor  without  any  effect  -  so  far  -  on  airworthiness.  Nor  has  the 
revision  of  the  existing  Procedures  for  Air  Navigation  Services  -  Aircraft  Operations 
(PANS-opS)  brought  any  progress  in  this  context.  The  new  PANS-OPS  contain,  among  other 
things,  new  and  modified  methods  for  the  determination  of  obs t ac 1 e- f ree  criteria.  The 
directive's  are  based  upon  results  achieved  with  the  help  of  scientific  methods  including 
a  Collision  Risk  Model  (CRM)  which  can  estimate  the  risk  of  a  collision  with  obstacles 
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under  given  marginal  conditions.  The  computer  model  will  be  put  at  the  disposal  of  the 
ICAO  member  States.  The  method,  however,  does  not  include  such  "extraordinary"  factors  as 
wind  shear  or  turbulence. 

A  special  hazard  to  flight  safety  during  both  take-off  and  go  around  can  be  created  when 
climb  capability  is  degraded  by  unfavourable  wind  conditions.  Wind  has  a  direct  influence 
on  the  flight  path  and,  as  a  result,  on  the  obstacle  clearance  height.  Wind  also  is  a  key 
factor  in  computing  the  maximum  allowable  take-off  weight. 

Wind  speed  and  direction  depend  upon  both  position  and  time.  In  other  words,  the  wind 
factor  is  a  continuous  variable  affecting  an  aircraft's  flight  path.  The  resulting  air¬ 
craft  dynamics  can  be  computed  only  with  the  aid  of  a  costly  simulator.  To  simplify  the 
take-off  procedure,  the  wind  is  considered  to  be  constant.  This  relative  wind  velocity  is 
measured  at  the  surface  and  a  median  speed  is  an  average  over  the  last  10  minutes.  As  far 
as  wind  speed  tor  take-off  is  concerned,  the  FAA  requires  that  neadwinds  be  calculated  at 
50%  of  the  nominal  value,  and  performance-decreasing  tailwinds  considered  at  150%. 

In  "worst-case"  situations,  the  variation  between  the  actual  wind  conditions  and  the  re¬ 
ported  median  can  be  as  high  as  80%.  Wind  shear  and  updrafts  or  downdrafts  are  not  included 
in  take-off  computations  despite  their  effect  on  the  climb-out  flight  path.  The  reasons  for 
this  is  the  current  lack  of  measuring  capabilities  and  the  long-standing  assumption  that 
the  vertical  wind  components  near  the  surface  are  so  small  they  may  be  ignored. 

Fig. 16  shows  gross  and  net  flight  paths  for  a  wind  simulation  as  indicated  in  fig. 4.  (The 
corresponding  flight  paths  under  no-wind  conditions  are  shown  in  fig. 14)  The  strong  in¬ 
fluence  on  flight  path  displacement  even  with  a  rolat  vely  low  headwind  of  Vw  =  10  kt  is 
quite  pronounced.  Both  aircraft  A  and  aircraft  B  are  well  below  the  10,7  m  minimum 
clearance  height  even  though,  according  to  the  regulations,  only  50%  of  the  headwind  compo¬ 
nent  is  used  to  compute  take-off  weight.  Without  the  influence  of  wind  shear  and  down- 
drafts,  the  actual  overflight  altitude  would  be  much  higher  than  the  minimum  allowable 
overflight  altitude  due  to  the  50%  “risk"  factor.  But  the  result  is  that  the  50%  "safety" 
factor,  in  the  given  wind  model,  is  completely  used  up.  In  the  often-underestimated  "lee 
influence",  the  low  flight  path  under  engine-out  conditions  can  be  wiped  out  by  a  downdraft 
velocity  of  0.12  m/ s  despite  the  improved  climb  performance  provided  by  a  headwind  of 
10  kt.  Additional  air  recirculation  or  variations  in  the  measured  wind  speeds  would  reduce 
obstacle-clearance  even  more. 

Despite  the  relatively  comparable  take-off  performance  of  the  two  hypothetical  aircraft 
(fig. 14),  the  two  aircraft  have  very  different  flight  paths  under  the  wind  conditions 
studied  (fig. 16).  The  reason  is  in  the  dynamic  reaction  of  the  aircraft  to  the  variable 
wind  conditions.  An  important  parameter  here  is  the  thrust  radius  -  the  geometric  distance 
between  the  engines  and  the  aircraft's  center  of  gravity  (CG)  -  and  the  relationship 
between  the  thrust  available  and  airspeed.  A  study  of  other  twin-engine  aircraft  indicates 
that  the  farther  below  the  CG  the  engines  are  mounted,  the  stronger  and,  in  general,  less 
favorable  are  the  aircraft's  dynamic  reactions  in  its  flight  path.  This  "problem",  however, 
should  not  be  overestimated  in  a  discussion  of  obstacle  clearances. 

For  1 ow-per f ormance  aircraft,  a  one-engine  go  around  can  be  far  more  critical  than  a 
take-off  (fig. 17).  Under  the  wind  parameters  shown  in  fig. 4,  aircraft  B  would  hit  the  ob¬ 
stacle.  Under  still-air  conditions,  the  clearance  height  would  be  marginal,  but  would  meet 
regul at  ions . 
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As  the-  response  ot  a  piloted  aircraft  differs  very  much  during  approach  and  landing  and 
on  the  other  hand  during  take-off  and  go  around,  the  procedures  for  accident  prevention 
are  quite  different. 

TAKE-OFF 

A  trivial  but  powerful  advise  would  be:  don't  start  under  thunderstorm  conditions.  The 
probability  to  survive  is  small  in  strong  thunderstorms  during  take-off. 

The  inclusion  of  wind  shear  considerations  excluding  thunderstorms  in  take-off  and  go  around 
regulations  makes  sense  only  when  related  to  specific  obstacle  conditions  and  when  certain 
weather  situations  can  be  predicted  with  some  probability.  It  also  would  be  necessary  to 
compute,  with  a  simulator,  the  actual  situation.  The  simulation  model  would  have  to  include 
actual  wind  values  as  measured  at  the  airport  in  question.  This  technique  could  be  suppor¬ 
ted  by  information  to  pilots  that  certain  wind  situations  could  occur  at  certain  airports 
and  the  pilots  should  be  alert  for  such  possibilities.  At  new  airports,  another  possibility 
would  be  the  consideration  of  the  statistical  distribution  of  the  main  wind  directions  as 
well  as  of  the  surrounding  terrain's  effect  on  the  wind.  Existing  airports  could  be  modi- 
ned  to  minimize  any  restrictions  on  flight  operations. 

The  reduction  of  flight  weight  to  provide  a  great  margin  of  safety  for  take-off  and  go 
around  -  especially  in  the  case  of  unforeseen  wind  shear  -  is  an  economic  factor  which  no 
one  regards  with  pleasure.  For  take-off,  it  has  been  shown  that  the  50%  headwind  factor 
provided  b\  the  FARs  can  be  completely  consumed  under  the  conditions  of  the  hypothetical 
wind  model  presented  here,  other  areas  such  as  inexact  wind  velocity  measurements  and  time- 
variable  winds  cannot  be  covered  by  the  50%  safety  factor.  It  would  seem  here,  that  an  in¬ 
creased  take-off  weight  due  to  a  ..eadwind  component  should  not  be  allowed  under  the  condi¬ 
tions  described.  It  has  been  shown  that  the  FARs  for  go  around  procedures  impose  far  lower 
requirements  than  for  take-off.  This  is  most  likely  based  upon  the  fact  that,  when  a  go 
around  decision  is  made,  the  altitude  and  course  already  exist  and  the  process  is  somewhat 
less  critical. 

If,  however,  an  engine  failure  is  assumed  at  go  around  decision  height  -  similar  to  the 
decision  speed  at  take-off  -  the  flight  distance  required  to  reach  a  safe  climb  speed  is 
quite  long.  Tn  this  case  the  FARs  should  require  that  gross  flight  paths  for  go  arounds 
under  the  marginal  conditions  noted  above  should  be  computed  and,  as  for  the  net  flight 
path,  provide  a  minimum  obstacle  clearance  of  10.7  m  in  the  "Balked  Landing"  sector.  It  is 
admitted  that,  according  to  the  examples  given,  the  authorized  maximum  landing  weight 
would  be  reduced  considerably,  but  a  safety  minimum  would  be  guaranteed. 

LANDING  APPROACH 

In  contrast  to  take-off  and  go  around  accidents,  wind  shear  accidents  during  approach  and 
landing  could  generally  be  avoided,  if  the  pilot  or  the  automatic  flight  control  system 
reacts  in  a  correct  manner.  In  all  approach  wind  shear  accidents,  analyzed  by  the  author, 
neither  limited  flight  performance  nor  slow  engine  response  time,  nor  exclusively  non- 
adequate  control  of  elevator  and  thrust  were  the  basic  reason  for  the  crash. 

As  mentioned  in  chapter  3,  the  total  energy  of  an  uncontrolled  aircraft  in  a  wind  shear 
situation  is  nearly  constant,  the  airspeed  deviations  are  negligibly  small  and  the  air¬ 
craft  will  be  accelerated  without  significant  time  delay  with  the  time  varying  wind.  The 
main  deviation  occurs  on  the  flight  path.  In  case  of  an  increasing  tailwind,  the  air¬ 
craft  would  be  accelerated  inertially  and  this  will  increase  the  kinetic  energy.  If  the 
total  energy  is  constant  the  potential  energy  and  therefore  the  height  has  to  decrease. 

From  this  unexpected  aircraft  response  results: 
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-  pilot  and  automatic  flight  control  system  can  neither  indicate  a  wind  shear  situation 
from  airspeed  deviation  nor  from  criteria  based  on  total  energy  deviation; 

-  a  powerful  wind  shear  indication  is  the  deviation  from  the  glide  path. 

It  can  be  assumed  that  flight  safety  will  be  guaranteed  in  a  wind  shear  situation  if  air¬ 
speed  and  flight  path  deviations  are  small.  In  this  case  additional  thrust  will  be  re¬ 
quired  to  accelerate  the  aircraft  without  flight  path  deviation. 

The  required  thrust  or  specific  excess  power  to  avoid  airspeed  and  flight  path  devia¬ 
tions  is  shown  in  fig. 18  curve  R  for  the  wind  shear  gradient  of  fig. 5. 

Today's  flight  control  systems  based  on  the  classical  concept  of  separating  autopilot  and 
autothrottle  can  already  reduce  the  hazards  of  wind  shear  to  a  considerable  amount.  In 
fig. 18,  curve  A,  the  throttle  activities  of  such  an  automatic  control  system  of  a  European 
wide-body  aircraft  is  given  in  the  above  mentioned  linear  tailwind  shear. 

A  comparison  with  the  required  values  (curve  R)  reveals  that  this  modern  flight  guidance 
and  control  system  executes  principally  correct  compensations. 

The  excursions  in  the  airspeed  and  flight  path  signals  originate  from  the  special  flight 
control  structure.  A  high  throttle  activity  as  a  response  to  higher  frequency  gusts  is 
avoided  here  by  means  of  a  complementary  filtering  technique.  This  brings  the  disadvantage 
of  a  delayed  counteraction  against  the  low  frequency  wind  shear  disturbances  only  after 
relatively  great  offsets  of  airspeed  and  flight  path  have  established. 

The  employment  of  stronger  cross-coupled  flight  control  systems,  no  longer  separated  into 
autopilot  and  autothrottle  and  operating  on  the  basis  of  an  energy  management  [14  Heads  to 
a  further  considerable  reduction  of  the  total  energy  excursions  while  using  conventional 
sensoring. 

By  means  of  an  additional  direct  open-loop  compensation  the  offsets  in  airspeed  and  flight 
path  caused  by  wind  shear  can  be  eliminated  almost  entirely  [111.  This  method  is  based  on 
the  on-board  measurement  of  the  wind  vector  components  and  their  time  derivatives  and  a 
corresponding  thrust  command  signal.  In  this  way  an  ideal  thrust  signal  in  wind  shear  is 
generated  (see  fig. 18,  curve  R)  without  changing  the  original  stability  of  the  controlled 
aircraft.  Two  main  disadvantages  have  to  be  noted,  however:  first,  complete  airdata  and 
inertial  data  must  be  available  on  board  the  aircraft  in  order  to  determine  the  wind  com¬ 
ponents.  Secondly,  the  above  mentioned  complementary  filtering  of  the  wind  signal  can  no 
longer  be  maintained  because  it  would  counteract  the  open-loop  activation  of  the  thrust 
due  to  its  structural  composition.  This  method  cannot  be  employed  successfully  until  the 
problem  of  separating  the  wind  shear  and  gust  signals  has  been  solved  completely. 

A  management  of  the  aircraft's  energy  and  energy  rate  (based  on  airspeed)  leads  despite  its 

simple  structure  to  very  small  deviations  of  the  airsoeed  and  height.  The  concept  for  such 

a  flight  control  system  can  be  derived  from  the  following  principle:  The  required  thrust  is 
proportional  to  the  deviation  in  specific  excess  power  H^.,  and  the  time  integral  of  HE,  the 

energy  height  error  AH^.,  is  an  indication  of  the  total  energy  state  of  the  aircraft  [1). 

The  specific  energy  rate  deviation  can  be  calculated  simply  by  a  linearized  approximation: 
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in  order  to  determine  this  equation,  no  expensive  measurement  is  necessary.  It  is  suffi¬ 
cient  to  combine  existing  sensor  signals.  Curve  B  in  fig. 18  shows  the  answer  of  the  spe¬ 
cific  energy  rate  and  the  corresponding  state  of  flight  variables  when  the  principle  of 
the  total  energy  rate  management  is  applied.  The  unimportant  deviations  of  the  airspeed 
and  height  are  substantially  referred  to  the  influences  of  engine  time  delays.  Neverthe¬ 
less,  filtering  of  the  V-  and  V-signals  is  still  necessary  in  order  to  prevent  the  thrust 
from  following  each  gust. 

Great  difficulties  for  pilots  occur  in  downdraft  or  downburst  situations.  To  maintain 
flight  safety  the  pilot  should  keep  angle  of  attack,  airspeed,  and  flight  path  angle  con¬ 
stant.  In  case  of  a  downdraft  the  pilot  has  to  pull  the  control  column  in  order  to 
increase  the  aircraft's  pitch  angle  141.  The  procedure  to  pitch  up  the  aircraft  in  a 
situation,  where  the  airspeed  decreases  (although  only  slightly),  is  adverse  to  the  pilots 
feeling  and  training.  As  downdraft  coun  leract ion  isn’t  generally  implied  in  most  flight 
director  control  laws,  the  pilot  tries  to  keep  the  pitch  angle  constant  with  the  result 
of  an  undesired  flight  path  deviation.  Therefore  pilots  should  be  trained  to  react 
adequately  in  downdraft  situations. 

WIND  SHEAR  WARNING  DISPLAY 

Concerning  the  prevention  of  wind  shear  accidents  the  major  problem  which  has  to  be 
solved  is  to  inform  the  pilot  in  a  proper  manner  about  his  situation.  In  principle  all 
sensor  signals  the  pilot  needs  for  a  proper  information  are  available  in  the  conventional 
cockpit  instrumentation.  Even  in  well  equipped  wide  body  aircraft  the  pilot  is  not  yet 
able  to  correlate  all  of  these  informations  in  order  to  realize  a  correct  warning. 

Wind  shear  can  be  described  by  characteristic  values,  of  the  shear  gradients,  the  thickness 
of  the  shear  layer  or  the  overall  shape  of  the  wind  changes.  On  board  the  aircraft  only 
the  momentary  wind  gradients  can  be  determined.  But  note  that  in  contrary  to  the  opinion 
among  experts  .13]  the  gradients  alone  are  no  exclusive  measure  for  the  hazard.  No  fore¬ 
cast  of  the  expected  total  event  of  the  wind  shear  can  be  given  based  only  on  the  know¬ 
ledge  of  the  momentary  wind  shear  gradients.  And  there  is  yet  no  evidence  that  an  aircraft 
is  more  endangered  by  a  high  wind  gradient,  lasting  only  a  short  time,  than  by  a  small  but 
persistent  gradient  which  is  possibly  not  recognized  by  the  pilot.  A  better  means  for 
evaluating  the  threat  of  a  wind  shear  to  the  aircraft  appears  to  be  an  energy  height  error. 
As  far  as  we  could  investigate,  energy  height  errors  of  the  magnitude  of  15  to  20  meters 
(resp.  kinetic  energy  errors  of  around  2.5  m/s)  may  be  tolerated  at  higher  altitudes 
during  take-off  and  landing.  However,  the  allowable  errors  have  to  be  obviously  narrowed 
with  decreasing  height  of  the  aircraft  above  the  around.  To  avoid  uncomfortable  and  un¬ 
necessary  miswarnings,  the  pilot  should  not  be  warned  until  these  limits  are  violated. 

It  appears  difficult  to  supply  the  pilot  with  another  information  in  view  of  the  great 
burden  of  control  task  ho  has  in  a  landing  approach.  The  question  arises  whether  to  in¬ 
stall  additional  instruments  or  to  modify  already  existing  displays.  This  is  more  or  less 
a  question  <>f  philosophy  that  is  certainly  goinq  to  answer  itself  when  new  or  modified 
instruments  fulfil  the  one  and  only  requirement:  They  must  display  the  proper  quantity 
that  will  only  warn  the  pilot  when  it  is  necessary,  and  that  will  qive  him  appropriate 
quidance  when  he  needs  it. 

The  concept  of  displaying  airspeed  based  on  energy  and  energy  rate  1)  (chapter  4)  has 
been  tested  in  a  moving  cockpit  simulator  by  a  joint  team  of  Bodenscewerk  Gera t e t echn l k , 
Deutsche  Forsrhungs-  und  Versuchsanstal t  fur  Luft-  und  Raumfahrt  (DFVI.R)  and  Technical 
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University  Braunschweig.  This  research  was  sponsored  by  the  German  Ministry  of  Transpor¬ 
tation  { BMV )  .01.  Fourteen  airline  pilots  flew  different  approaches,  where  the  New  York 

thunderstorm  profile  .7)  (fig.lu,!!)  caused  the  heaviest  problems.  In  the  absence  of 
additional  aircraft  systems,  e.g.  autopilot  wind  shear  warning,  none  of  the  well  motiva¬ 
ted  pilots  were  able  to  land  the  simulated  wide  body  aircraft  without  a  crash,  even 
though  the  response  of  experienced  pilots  was  different  from  less  experienced  pilots, 
(curve  1,  tig. 10, 11) 

With  the  display  of  energy  and  energy  rate,  most  of  the  pilots  recovered  in  a  hard  but 
safe  landing  (fig. 10, 11,  curve  2).  During  these  simulator  studies  the  questions  arose,  if 
it  is  worthwhile  to  display  energy  and  energy  rate  in  different  instruments  or  to  combine 
both  signals  in  one  display  C 1 2  ) .  This  question  shall  be  answered  in  an  additional  simula¬ 
tor  study,  where  man-machine  problems  will  be  optimized.  The  main  results  of  the  simulator 
studies  were: 

-  pilots  (both  well  or  less  experienced)  are  not  able  to  make  a  safe  landing  under  severe 
wind  shear  conditions  without  additional  support  of  an  automatic  flight  control  system 
or  an  adequate  wind  shear  warning  display; 

-  if  there  is  enough  training  available,  pilots  can  adapt  themselves  to  specific  wind 
shear  profiles.  It  is  therefore  necessary  to  expost?  the  pilot  to  different  wind 
shear  situations.  A  general  ground  based  wind  shear  warning  is  worthwhile  but  not 
suf  f ic lent ; 

-  an  adequate  wind  shear  warning  display  can  support  the  pilot  in  the  most  severe  wind 
shear  situations. 

5 .  CONCLUS IONS 

Wind  shear  during  take-off,  go  around,  and  missed  approach  is  a  pure  flight  performance 
problem.  Pilots  should  avoid  to  take  off  into  thunderstorms.  Moderate  wind  shear  induced 
by  orographic  iee  effects  can  be  overcome  by  increasing  the  thrust  to  weight  ratio, 
especially  in  engine  failure  conditions.  In  unexpected  dangerous  situations  the  pilot  is 
advised  to  reduce  the  airspeed  safety  margin  in  order  to  increase  the  obstacle  clearance. 
Wind  shear  accidents  during  landing  and  approach  could  generally  be  avoided  if  the  pilot 
keeps  the  automatic  flight  control  systems  in  operation  and  if  he  is  informed  by  an 
adequate  wind  shear  earning  display.  Wind  shear  is  particularly  dangerous  if  it  occurs  in 
a  height  of  approximately  80-120  m. 

A  ground  based  wind  shear  warning  is  worthwhile  but  not  sufficient.  The  adequate  informa¬ 
tion  of  the  aircraft  response  in  wind  shear  can  only  be  measured  on  board.  A  major  para¬ 
meter  is  airspeed:  high  airspeed  leads  to  greater  flight  path  deviation. 
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.  6:  Landing  approaches  in  headwind  resp.  tailwind  shear,  controls  fixed  [ 1 J 
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Fio.  7:  TaKc-off  fliqht  path  in  tailwind  shear, 
controls  fixed  111 
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Fig.  8:  Fliqht  path  of  an  aircraft  with  fixed  controls 
in  a  constant  vertical  wind  shear  gradient  uWz 
(£  =  Eigenvalue  of  phugoid  mode,  see  fiq.  9) 


Fiq.  9:  Eigenvalues  of  the  phunoid  mode  as  a  function  of 
a  constant  vertical  wind  shear  gradient  uWz  [51 
(Index  R:  Referencedata) 
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Fig.  14:  Takeoff  flight  paths  of  two  twin-enciined  jet  aircraft  under  conditions  of 
obstacle-limited  takeoff  weights  and  an  enaine  failure  at  V1  [3] 


Fiq.  18:  Effects  of  flight  controls  activity  in 
linear  tailwind  shear. 

R:  Required  specific  enerqy  rate 
A:  Conventional  automatic  fliqht  controls 
B:  Specific  enerqy  rate  mangaqement 


SOME  COMMENTS  ON  THE  HAZARDS  ASSOCIATED  WITH  MANOEUVRING 
FLICjHT  IN  SEVERE  TURBULENCE  AT  I  IK, 1 1  SPEED  AND  LOW  ALTITUDE 


J.  Burnham 

Director,  Defence  Science  2/5 
Ministry  of  Defence.  Main  Building 
Whitehall  (Room  2.M0) 
London  SW I A  21  IB 
UK 


1.  INTRODUCTION 

This  paper  briefly  describes  the  results  of  some  calculations  which  were  made,  following 
several  accidents  and  incidents  during  service  training,  in  the  hope  of  providing  an  insight 
into  risks  associated  with  encounters  with  severe  turbulence  during  high  speed  aanoeuvring 
flight  at  low  altitude.  In  that  sense,  what  is  discussed  here  is  an  attespt  to  learn 
lessons  from  operational  experience.  But  that  is  not  to  be  taken  to  isply  that  the  phenomena 
described  are  necessarily  the  cause  of  any  particular  accident  or  incident. 

Two  dangers  will  be  considered;  that  a  combination  of  gust  and  manoeuvre  loads  nay  be 
sufficiently  high  to  cause  structural  failure,  or  that  this  combination  may  result  in  a 
stall  or  other  departure  froa  controlled  flight  from  which  recovery  is  impossible  due  to 
the  proximity  of  the  ground.  In  what  follows  these  will  first  be  treated  separately, 
then  compared  and  then  an  attempt  will  be  made,  using  turbulence  statistics,  to  indicate 
the  order  of  probability  which  might  apply.  Finally  some  implications  of  the  results  are 
briefly  discussed. 

This  paper  is  about  high  speed  low  level  flight  by  military  combat  aircraft.  Such 
aircraft  are  capable  of  achieving  and  sustaining  high  sanoevuring  accelerations.  This 
capability  is  used  in  terrain  following,  in  aanoeuvring  to  take  advantage  of  terrain  screening 
and  for  other  tactical  reasons  such  as  to  break  the  lock  of  an  air  defence  radar  which 
is  tracking  the  aircraft. 

The  results  presented  here  relate  to  an  in-service  strike  fighter  at  sea  level  but 
are  not  an  accurate  representation  of  any  particular  aircraft.  Much  of  the  discussion  which 
follows  is  over-simplified  in  order  to  emphasise  the  more  important  aspects  and  because 
any  attempt  at  greater  accuracy  would  involve  detailed  information  about  specific  aircraft 
which  is  not  available  in  the  open  literature.  Although  the  approximations  used  here 
are  reasonable  for  present  purposes  for  the  class  of  aircraft  concerned,  these  approximations 
may  not  provide  a  useful  approximation  to  other  classes  of  aircraft  and  the  conclusions 
drawn  should  not,  without  further  consideration,  be  taken  to  apply  to  these.  All  that  the 
present  paper  attempts  to  do  is  to  indicate  the  existence  of  a  possible  problem  area  which 
appears  to  have  received  little  attention  in  the  past.  It  must  be  for  those  with  a  detailed 
knowledge  of  a  particular  aircraft  and  of  the  way  in  which  it  is  used  in  service,  to  consider 
this  problem  area  and  determine  whether  it  is  likely  to  be  significant  in  their  case. 

2.  GUST  EFFECTS 

2.1  Structural  Loads.  The  normal  acceleration  produced  by  a  gust  normal  to  the  flight  path 
of  an  aircraft  varies  approximately  as  the  product  of  the  aircraft  speed  and  lift  curve 
slope  and  inversely  as  the  aircraft  mass.  This  is  illustrated,  for  a  typical  strike  fighter 
encountering  a  relatively  sharp-edged  15  a/aec  gust  in  level  flight,  in  Fig  1,  which  shows 
the  total  load  rather  than  the  load  increment  due  to  the  gust.  Such  an  aircraft  would  be 
cleared  to  some  8  or  9g  at  combat  mase,  with  a  safety  factor  of  about  1.5«  It  is  apparent 
from  Fig  1  that  a  very  large  gust  indeed  would  be  required  to  break  such  an  aircraft  if 

the  gust  were  encountered  during  straight  and  level  flight. 

Since  the  normal  acceleration  produced  by  a  gust  varies  approximately  inversely  as 
aircraft  mass,  it  follows  that  the  actual  structural  load  which  it  produces  is  almost 
independant  of  the  aircraft  mass.  The  variation  of  the  combined  normal  load  produced  when 
a  15  n/oac  gust  normal  to  the  aircraft  flight  path  is  encountered  during  a  manoeuvre  is 
illustrated  in  Fig  2.  The  load  increases  strongly  with  aircraft  mass  at  constant  manoeuvre 
acceleration.  However,  as  illustrated  in  Fig  },  the  total  combined  gust  and  manoeuvre 
acceleration,  which  is  what  the  pilot  feels,  decreases  at  constant  manoeuvre  g  as  mass 
increases.  As  indicated  earlier,  at  constant  aircraft  mass  the  normal  acceleration  and 
the  load  produced  by  a  gust  is  approximately  directly  proportional  to  airspeed,  as 
illustrated  in  Fig  k. 

2.2  Handling  Effects.  For  the  typical  strike  fighter  considered  here,  the  change  in  incidence 
produced  by  a  relatively  sharp  edged  15  sec  gust  and  the  resulting  change  in  lift 
coefficient  are  shown  in  Fig  5.  Both  incremental  incidence  and  incremental  lift  coefficient 
decrease  as  airspeed  increases,  both  being  approximately  inveraely  proportional  to  airspeed. 
The  lift  coefficient  required  to  produce  a  given  manoeuvre  acceleration  at  combat  mass 

and  its  variation  with  airspeed  is  shown  in  Fig  6.  In  this  case  the  lift  coefficient 
varies  inversely  as  the  square  of  the  airspeed.  The  lift  coefficient  produced  by  a 
combination  of  gust  and  manoeuvre  ia  shown  in  Fig  7.  Aircraft  of  the  kind  considered  here 
are  often  unable  to  achieve  and  sustain  values  of  lift  coefficient  as  high  as  those  shown 
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at  the  higher  values  of  aasa  and/or  lower  values  of  speed.  Undesirable  handling  character¬ 
istics  such  as  stall  departure,  wing  rock,  nose  slice tetc  say  be  encountered  at  these  or 
lower  values  of  lift  coefficient.  Since  the  situation  under  consideration  is  one  in  which 
the  aircraft  is  flying  at  high  speed  close  to  the  ground,  encounters  with  phenoaena  of 
this  kind  seea  likely  to  be  disasterous. 

Coopering  the  values  of  lift  coefficient  shown  in  Fig  7  with  the  values  of  structural 
load  shown  in  Fig  2,  it  appears  that  encounters  with  severe  gusts  during  oanoeuvring 
flight  are  oore  likely  to  result  in  handling  difficulties  than  in  direct  structural 
failure.  Before  attempting  to  reach  a  conclusion,  however,  it  is  necessary  to  examine 
some  transient  aerodynamic  phenoaena  and  this  is  done  in  the  next  section. 

The  gust  induced  acceleration  and  so  the  bumpiness  of  the  ride  felt  by  the  pilot, 
increases  with  speed,  as  shown  in  Fig  8.  However,  when  flying  in  turbulence,  speed 
reduction  to  improve  ride  quality  or  perhaps  to  assist  weapon  aiming,  greatly 
increases  the  likelihood  of  enoounters  with  the  handling  problems  referred  to  above, 
unless  the  amount  of  manoeuvre  acceleration  used  is  reduced  appropriately.  For  the 
aircraft  considered  here,  the  available  manoeuvre  acceleration  at  coobat  mass  if  an 
encounter  with  a  15  m/sec  gust  is  not  to  result  in  lift  coefficients  in  excess  of  0.8, 

1.0  and  1.2  is  shown  in  Fig  9.  The  rapid  reduction  of  available  manoeuvre  acceleration 
as  airspeed  is  reduced  is  readily  apparent,  as  is  the  effect  of  variation  of  the  value 
of  lift  coefficient  which  is  selected  as  that  which  is  not  to  be  exceeded. 

2.3  Transient  Penetration  of  Manoeuvre  Boundaries.  It  is  well  known  that  values  of 
lift  coefficient  significantly  greater  than  those  of  the  steady-state  still  can  be 
achieved  when  normal  acceleration  is  applied  rapidly  to  an  aircraft.  Much  less  is 
known  about  what  occurs  when  a  wing  is  stalled  by  encountering  a  relatively  sharp-edged 
gust  which  increases  the  incidence  to  a  value  above  that  at  which  the  steady  stall 
occurs.  Ref  1,  although  concered  with  a  somewhat  different  question,  gives  some  idea 
of  what  happens.  Fig  10  sketches  the  kind  of  flow  which  occurs  when  an  infinite  wing 
of  moderate  or  lower  sweep  encounters  a  sharp-edged  gust  aligned  with  its  leading 
edge.  A  vortex  with  axis  parallel  to  the  leading  edge  is  shed  from  it  and  moves 
back  over  the  wing  producing  a  suction  peak  over  the  top  surface  as  it  goes.  The 
existence  of  this  vortex  can  be  readily  demonstrated  by  placing  the  hand  in  a  fast 
moving  stream  (of  water)  and  changing  its  incidence  quickly. 

In  addition  to  generating  lift,  as  it  moves  over  the  wing  the  vortex  produces  a 

large  and  rapidly  varying  pitching  moment.  Another  such  occurs  when  the  gust,  followed 

somewhat  later  by  the  vortex,  passes  over  the  tail  of  the  aircraft.  On  a  swept  wing 
aircraft  a  pitching  moment  will  also  be  generated  as  the  wing  becomes  immersed  in  the 
gust. 

The  dependence  of  the  behaviour  of  the  flow  on  how  sharp-edged  is  the  gust  is  not 
clear,  even  in  this  simple  case;  nor  are  the  3-dimensional  effects  when  a  swept  wing 
aircraft  encounters  a  gust  front  normal  to  the  aircraft's  flight  path.  The  real 
situation  is  also  likely  to  be  complicated  for  a  variety  of  other  reasons.  The  gust 
is  unlikely  to  be  aligned  at  right  angles  to  the  aircraft  flight  path  nor  is  the  gust 

likely  to  have  a  component  only  in  the  plane  normal  to  it.  Thus  large  forces  may 

be  generated  which  disturb  the  lateral  as  well  as  the  vertical  motion  of  the  aircraft 
and,  in  particular,  large  rolling  moments  may  be  generated  on  swept  wing  aircraft. 

Secondly  for  aircraft  on  which  the  high  lift  coefficients  are  achieved  by  vortex 
dominated  flows,  little  appears  to  be  known  about  such  transient  gust  effects.  Thirdly, 
it  is  often  the  case  that  the  limiting  lift  coefficient  or  incidence  is  determined  by 
some  phenomenon  such  as  pitch-up,  wing  rock  etc  rather  than  by  a  conventional  stall. 

The  behaviour,  in  the  transient  conditions  under  consideration,  of  the  flow  fields 
which  are  responsible  seems  likely  to  be  configuration  dependant  and  little  seems  to 
be  known  about  it  in  general  terms.  Fourthly,  the  gust  may  be  localised  so  that 
the  aircraft  traverses  it  sufficiently  quickly  that  there  is  insufficient  time  for 
the  aircraft  to  diverge  significantly  from  its  flight  path.  The  question  would  then 
arise  as  to  the  speed  with  which  the  original  flow  is  re-established.  For  an  aircraft 
flying  at  a  height  of  some  30  metres,  little  comfort  can  be  drawn  from  this  fourth 
point.  However,  not  all  of  the  effects  considered  above  are  necessarily  unfavourable. 

The  achievement  of  lift  coefficients  significantly  greater  than  can  be  achieved 
in  steady  conditions  may  affect  the  consideration  of  the  relative  probabilities  of 
occurence  of  structural  failure  and  handling  problems.  It  should  also  be  noted  that 
the  way  in  which  the  high  values  of  lift  coefficient  are  generated  may  change  the 
structural  failure  mode  which  would  apply. 

The  motion  of  an  aircraft  following  a  rapid  gust  induced  penetration  of  a  manoeuvre 
boundary  will  be  influenced  by  the  behaviour  of  its  flight  control  system.  This  is 
likely  to  be  particularly  important  if  a  stall  prevention/ departure  suppression/aanoeuvre 
limiting  or  other  carefree  manoeuvring  system  is  fitted.  How  such  a  system  would 
behave  would  depend  on  the  details  of  its  design  and  method  of  operation,  but  it  would 
not  necessarily  behave  in  the  situation  considered  here  in  the  same  way  as  it  would 
behave  in  a  pilot  induced  manoeuvre.  If  the  probability  of  gust  induced  penetrations 
of  manoeuvre  boundaries  is  as  high  as  is  implied  by  the  present  paper  it  is  important 
that  flight  control  aspects  are  considered  and  that  they  be  taken  into  account  in 
flight  control  system  design.  This  would  be  no  simple  matter.  The  accuracy  with 
which  the  aerodynamic  forces  are  known  is  likely  to  be  much  lower  than  that  which  the 
flight  control  system  designer  has  learnt  to  expect  and  it  is  far  from  clear  that 
the  conventional  stability  derivative  approach  can  be  applied  in  the  present  situation. 
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Perhaps  the  only  safe  generalisation  which  can  be  made  is  that  in  the  present  situation 
as  in  others,  aircraft  with  relatively  "soft"  manoeuvre  boundaries  are  likely  to  behave 
in  a  more  benign  fashion  than  would  aircraft  for  which  the  manoeuvre  boundaries  are  "hard". 

3.  OCCURENCES  OP  EXTREME  VALUES  OF  LIFT  COEFFICIENT  IN  SEVERE  TURBULENCE 

Ref  2  quotes  data  from  extensive  measurements  made  at  low  altitudes  over  mountainous 
terrain  in  the  western  USA.  Fig  11  is  reproduced  from  it.  Noting  that  in  a  hard 
horizontal  turning  manoeuvre  it  is  the  lateral  (with  respect  to  the  ground)  turbulence 
component  which  produces  incidence  changes  on  an  aircraft  and  that  only  gusts  in  one 
(rather  than  in  either)  direction  will  produce  extreme  values  of  lift  coefficient, 
the  lateral  gust  probabilities  of  Fig  11  have  been  used  to  calculate  the  average 
periods  for  which  a  given  manoeuvre  acceleration  must  be  applied  before  values  of 
lift  coefficient  of  0.8,  1.0  and  1.2  are  achieved  at  Mach  numbers  of  0.7  and  0.9  at  combat 
mass  and  at  a  Mach  number  of  0.7  at  0.64  times  combat  mass.  The  results  are  shown  in 
Fig  12. 

In  severe  turbulence  with  characteristics  as  indicated  in  Fig  11,  when  flying  at 
combat  mass  at  a  Mach  number  of  0.7  lift  coefficients  exceeding  1.2  are  likely  to  occur 
on  average  about  once  per  minute  of  manoeuvring  flight  at  7g,  with  lower  values  of  lift 
coefficient  occuring  more  frequently,  for  example  lift  coefficients  of  1.0  occuring  on 
average  about  once  every  3  seconds.  To  retain  the  same  once  per  minute  probability  of 
occurence,  at  lift  coefficients  of  1.0  and  0.8  the  manoeuvre  acceleration  would  have 
to  be  reduced  to  5*8g  end  4.5g  respectively.  At  combat  mass  the  frequency  of  occurence 
is  reduced  (or  the  average  time  between  occurences  is  increased)  by  a  factor  of  10  for 
every  reduction  of  1g  in  the  manoeuvre  acceleration.  A  much  more  dramatic  reduction 
in  the  frequency  of  occurence,  this  time  by  a  factor  of  the  order  of  1000,  occurs  for 
fixed  values  of  lift  coefficient  and  manoeuvre  acceleration  when  the  speed  is  increased 
from  a  Mach  number  of  0.7  to  0.9.  for  the  present  aircraft  at  combat  mass,  a  lift 
coefficient  of  1.2  corresponds  to  some  12g  at  a  Mach  number  of  0.9  and  some  8g  at  0.7. 

Again,  as  mass  is  reduced  the  average  time  between  occurences  of  given  values  of  lift 
coefficient  increases  markedly  if  manoeuvre  acceleration  is  kept  constant. 

For  simplicity,  the  calculations  reported  here  assume  that  the  aircraft  was  flying 
at  sea  level  and  the  turbulence  data  shown  in  Fig  11  has  been  taken  as  applying  to  that 
altitude.  However,  although  that  data  was  measured  at  a  low  altitude  with  respect  to 
the  terrain,  the  measurements  were  made  over  the  western  USA  where  the  terrain  itself 
is  some  5000ft  or  more  above  sea  level.  High  speed  low  level  operational  training  is 
carried  out  in  this  area  and  it  should  be  noted  that  the  effect  of  increasing  altitude 
to  5000ft  at  constant  TAS  would  be  to  reduce  the  time  between  encounters  with  particular 
values  of  lift  coefficient  by  a  factor  of  about  5  if  the  manoeuvre  acceleration  remains 
constant. 

4.  CONCLUDING  REMARKS 

To  convert  the  above  into  an  appreciation  of  how  often  significant  values  of  lift 
coefficient  are  likely  to  be  exceeded  in  operational  service  requires  two  further  kinds 
of  information.  First,  data  on  the  frequency  of  occurence  of  turbulence  of  various 
degrees  of  severity  for  the  regions  in  which  the  flying  takes  place.  Secondly  how  much 
time  is  spent,  on  average,  at  particular  values  of  high  manoeuvre  acceleration  at  various 
airspeeds.  In  addition  to  the  data  shown  in  Fig  11,  Refs  2  and  3  indicate  various 
sources  of  further  data  on  turbulence  intensities  and  much  other  dat  exists.  This 
should  be  adequate  for  an  initial  examination  although  the  available  uata  is  unlikely 
to  answer  all  questions.  If  any  information  exists  on  the  second  question  it  is  only 
likely  to  be  available  to  those  who  operate  the  aircraft. 

If  consideration  of  what  has  been  presented  earlier  in  this  paper  is  thought  to 
indicate  the  existence  of  a  hazard  which  is  sufficiently  significant  that  action  should 
be  taken  to  reduce  it,  and  this  will  depend  primarily  on  the  high  incidence  behaviour 
of  the  particular  aircraft  considered  and  on  the  way  in  which  it  is  flown,  the  question 
arises  as  to  what  this  action  might  be.  Awareness  of  the  need  to  reduce  applied 
manoeuvre  acceleration  as  airspeed  is  reduced  is  perhaps  the  most  important  point.  Also, 
severe  turbulence  as  discussed  here  is  usually  forecastable  and  levels  of  manoeuvre 
acceleration  could  be  reduced  when  flying  in  situations  when  it  has  been  forecast. 

Severe  turbulence  at  low  altitudes  over  hilly  or  mountainous  terrain  is  often  localised 
and  so  the  concept  that  the  pilot  will  be  aware  of  the  severity  of  the  conditions  from 
the  seat  of  his  pants  and  so  reduce  the  manouvre  accelerations  which  he  applies  would 
at  best  provide  only  a  partial  solution. 

Whatever  may  be  regarded  as  the  degree  to  which  the  hazards  discussed  in  this  paper 
apply  to  particular  present  operations,  it  appears  that  they  need  to  be  taken  into  account 
in  the  design  of  flight  control  systems,  particularly  when  these  are  intended  to  provide 
a  "carefree  manoeuvring"  capability. 
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SUMMARY:  The  relative  probability  during  maneouvring  flight  at  high  speed  and  low 

level  in  severe  turbulence  of  structural  failure  or  of  the  inadvertent 
penetration  of  maneouvre  boundaries  is  discussed.  It  is  concluded  that  for 
a  typical  current  strike  fighter  the  latter  is  much  the  more  likely.  The 
complexity  of  some  of  the  phenomena  involved  is  described  and  the  importance 
of  considering  such  hazards  in  the  design  of  flight  control  systems  is 
emphasised. 
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exceeded  on  encountering  a  15  m/sec  gust 
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Although  significant  strides  have  been  made  in  recent  years  toward  improving  aviation 
safety,  mishaps  involving  all  classes  of  helicopters  presently  are  and  will  continue  to  be 
a  major,  expensive  US  Army  problem  in  terms  of  casualties,  materiel  loss,  and  reduction  in 
mission  effectiveness.  Modern-day  training  and  tactical  employment  requirements  for  the 
US  Army  helicopter  dictate  that  a  large  percentage  of  operations  occur  in  the  low-speed, 
low-altitude  flight  regime,  which  contributes  to  the  problem  by  reducing  critical  margins 
of  safety  normally  associated  with  higher  airspeed  and  higher  altitude  operations  with 
accompanying  greater  time  for  response  in  case  of  an  emergency.  This  increased  probability 
of  accident  occurrence,  coupled  with  the  lack  of  an  in-flight  egress  capability,  makes 
design  for  crashworthiness  essential  for  Army  helicopters. 


A 

This  paper  discusses  the  evolution  of  crash  survival  design  criteria,  its  influence 
on  the  formulation  of  a  US  Army  military  standard  for  rotary-wing  aircraft  crashworthiness, 
and  its  application  to  current  and  new-generation  Army  helicopters.  Emphasis  is  given  to 
the  need  for  a  total  systems'  approach  in  design  for  crashworthiness  and  the  necessity  for 
considering  crashworthiness  early  in  the  design  phase  of  a  new  aviation  weapon  systems 
development  effort.  The  actual  application  of  crashworthiness  to  Army  helicopters  is  pre¬ 
sented  with  statistics  that  show  dramatic  reductions  in  fatalities  and  injuries  with 
implementation  of  a  crashworthy  fuel  system.  Current  and  planned  US  Army  PSD  to  improve 
crashworthiness  technology  is  discussed,  including  full-scale  crash  testing,  human  toler¬ 
ance  definition,  improved  energy  absorbers,  crew  restraint  systems,  and  crash  impact 
characteristics  of  composite  helicopter  structures.  Applicability  of  the  work  within  Army 
helicopter  crashworthiness  to  commercial/civil  helicopters  is  shown.  The  cost  effective 
aspects  of  designing  helicopters  to  be  more  crash  survivable  are  also  discussed. 


INTRODUCTION 

Research  investigations  directed  toward  improving  occupant  survival  and  reducing 
materiel  losses  in  aircraft  crashes  have  been  conducted  by  the  Army  for  more  than  20  years. 
However,  up  until  approximately  10  years  ago  the  principal  emphasis  within  Army  aviation 
survivability  was  placed  on  accident  prevention.  Although  this  is  indeed  the  ultimate 
objective  deserving  priority  effort,  past  experience  clearly  shows  that  accident  prevention 
alone  simply  is  not  sufficient.  Mishaps  of  all  natures  involving  Army  aircraft  have  been, 
are,  and  will  continue  to  be  a  major,  expensive  problem.  Research  has  been  accomplished 
on  accidents  worldwide  involving  Army  aviation,  and  accident  histories  are  routinely  dis¬ 
seminated  throughout  the  Army.  Unfortunately,  too  many  lessons  learned  from  these  accident 
histories  are  not  applied  and  hazardous  design  features,  human  errors,  and  operational 
errors  are  repeated  year  after  year.  Too  many  Army  aircrewmen  are  still  being  fatally 
injured  in  potentially  survivable  accidents,  and  the  percentage  of  major  injuries  and  rate 
of  materiel  losses  are  still  unacceptably  high.  There  is  no  easy  solution  to  the  problem. 
Significant  gains  can  be  made,  however,  toward  reducing  these  unacceptable  accident  losses, 
but  to  do  so  we  must  aggressively  pursue  a  program  that  addresses  key  issues  of  both  acci¬ 
dent  prevention  and  crashworthiness  design.  Since  the  helicopter's  potential  for  accident 
Is  great  due  to  its  mission  and  the  environment  in  which  it  must  accomplish  that  mission, 
it  is  imperative  that  it  be  engineered  to  minimize  damage  and  enhance  occupant  survival  in 
crashes.  In  designing  helicopters  to  be  more  crash  survivable,  two  subissues  then  become 
paramount:  establishing  viable  crashworthiness  design  criteria,  and  the  more  difficult 

task,  applying  these  crashworthiness  criteria  to  Army  aircraft  design. 

To  help  establish  the  severity  of  the  problem  within  US  Army  aviation,  Table  1  pro¬ 
vides  a  summary  of  accident  statistics  for  Army  helicopters  for  the  period  of  time  from 
1972  to  1982.  With  the  exception  of  the  OH-6,  these  aircraft  are  still  in  the  operational 
fleet  and  comprise  the  bulk  of  the  Army's  helicopters.  None  of  these  aircraft  had  crash- 
worthiness  in  their  basic  design.  During  the  period  reviewed  there  were  over  900  helicop¬ 
ter  incidents/accidents  with  over  400  occupant  fa tal i t ies .  The  fatalities  would,  without 
question,  have  been  more  severe  had  not  the  aircraft  been  retrofitted  in  the  early  to  mid- 
70s  with  crashworthy  fuel  systems.  Considering  the  personnel  aspects  in  the  crashes  of 
these  helicopters,  the  two  columns  on  the  right  reflect  that  there  were  survivors  in  more 
than  65  percent  of  all  of  the  accidents,  but,  more  important,  that  nearly  one-third  of  all 
the  fatalities  occurred  in  accidents  where  there  were  survivors.  It  can  be  seen  that  the 
costs  associated  with  these  accidents  in  terms  of  men  and  materiel  replacement  are  quite 
high.  These  costs,  however,  do  not  reflect  the  potentially  significantly  greater  costs 
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TABLE  1.  ARMY  HELICOPTER  ACCIDENT  HISTORY  1972-1982,  NONCRASHWORTHY  AIRCRAFT 


ACFT 

NO.  OF 
ACC  ID 

NO.  OF 
PSNL 

NO.  OF 
INJURIES 
MINOR  MAJOR 

NO.  OF 
FATAL¬ 
ITIES 

COST-M 
(MEN 
&  MATL) 

%  ACCID 
WITH 

SURVIVORS 

%  FATAL  IN 
ACCID  WITH 
SURVIVORS 

UH-1 

426 

1852 

300 

210 

229 

132 

82 

34 

OH-58 

235 

533 

97 

76 

59 

28 

86 

25 

AH- 1 

156 

301 

51 

37 

35 

52 

88 

26 

OH-6 

72 

160 

44 

19 

9 

5 

93 

22 

CH-47 

32 

277 

36 

9 

100 

44 

78 

10 

TOTAL 

ACFT 

921 

3123 

528 

351 

432 

261 

85 

26 

that  are 

associated  with 

loss  of 

mission 

capability 

.  Further 

,  these  statistics  are  based 

on  current  peacetime  experience  which  reflects  a  total  cumulative  flight  time  of  approxi¬ 
mately  lb  million  hours  per  year  for  Army  aviation  with  a  fatality  rate  of  approximately 
2.5  per  100,000  hours  of  flying  time.  The  severity  of  the  problem  increases  severalfold 
during  periods  of  combat,  as  demonstrated  in  Vietnam  when,  during  the  height  of  the  con¬ 
flict,  total  helicopter  flight  time  was  in  excess  of  5  million  hours  per  year  with  the 
fatality  rate  of  10  per  100,000  hours. 

Data  from  these  accident  and  crash  injury  investigations  (Reference  1)  have  revealed 
deficiencies  in  the  crashworthiness  of  the  older,  existing  Army  helicopters.  Key  defi¬ 
ciencies  include: 

.  Structural  collapse  (roof  downward  and  floor  upward)  causing  loss  of  occupiable 
volume 

.  Inward  buckling  of  frames,  longerons,  etc.,  causing  penetration  wounds  to  personnel 

.  Lethal  internal  structure  causing  head,  chest  and  extremity  injuries  from  occupant 
f lai ling 

Floor  breakup  permitting  seats  to  tear  out  and  occupants  to  become  flying  missiles 

.  Landing  gear  penetration  into  occupied  areas  and  fuel  systems  causing  contact 
injuries  and  fires 

.  Landing  gears  not  designed  for  sufficiently  high  sink  rates  and  insufficient  deform 
able  airframe  structure  permitting  excessive  acceleration  (G)  forces  to  be  trans¬ 
mitted  to  the  occupants  and  causing  excessive  materiel  damage 

.  Intrusion  of  the  occupied  area  by  the  main  rotor  gearbox  and  other  high  mass  items 
causing  crushing  and  contact  injuries  to  the  occupants 

.  Insufficient  structural  stiffness  permitting  inward  crushing  and  entrapment  of 
occupants  in  rollover  accidents 

It  has  been  demonstrated,  however,  that  significant  gains  can  be  made  toward  reducing  the 
severity  of  these  and  related  problems  through  the  judicious  development  and  application 
of  crashworthiness  design  features  into  Army  aircraft. 


CRASHWORTHINESS  DESIGN  CRITERIA 

In-depth  assessment  of  available  crash  data  was  first  accomplished  in  the  mid-60s  by 
a  joint  Government/industry  review  team.  The  product  of  that  team  was  the  world's  first 
crash  survival  design  guide  for  light  fixed-  and  rotary-wing  aircraft,  published  in  1967. 
Revisions  to  this  guide  were  made  in  1969,  1971,  and  1980  (Reference  2).  This  design  guide 
was  subsequently  converted  into  a  military  standard  (MIL-STD-1290 )  in  1974  (Reference  3) 
which  is  presently  undergoing  revision.  MIL-STD-1290  addresses  five  key  areas  that  must 
be  considered  in  designing  a  helicopter  to  conserve  materiel  and  provide  the  necessary 
occupant  protection  in  a  crash: 

.  Crashworthiness  of  the  structure — assuring  that  the  structure  has  the  proper 

strength  and  stiffness  to  maintain  a  livable  volume  for  the  occupants  and  prevent 
the  seat  attachments  from  breaking  free 

.  Tie-down  chain  strength--assuring  that  the  high  mass  items  such  as  the  transmission 
and  engine  do  not  break  free  from  their  mounts  and  penetrate  occupied  areas 

.  Occupant  acceleration  environment--providing  the  necessary  crash  load  absorption 
by  using  crushable  structures,  load  limiting  landinq  gears,  energy-absorbing  seats, 
etc.,  to  keep  the  loads  on  the  occupants  within  human  tolerance  levels 

.  Occupant  environment  hazards--providinq  the  necessary  restraint  systems,  padding, 
etc.,  to  prevent  injury  caused  by  occupant  flailing 

.  Postcrash  hazards--af ter  the  crash  sequence  has  ended,  providing  protection  against 
flammable  fluid  systems  and  permitting  egress  under  all  conditions 


A  survivable  crash  is  generally  defined  as  one  wherein  the  impact  conditions  inclusive 
of  pulse  rate  onset,  magnitude,  direction  and  duration  of  the  accelerative  forces  that  are 
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transmitted  to  the  occupant  do  not  exceed  the  limits  of  human  tolerance  for  survival,  and 
in  which  the  surrounding  structure  remains  sufficiently  intact  during  and  after  impact  to 
permit  survival.  Thus,  helicopters  designed  to  meet  MIL-STD-1290  shall  be  designed  to 
prevent  occupant  fatalities  and  minimize  the  number  and  severity  of  injuries  during  crash 
impacts  of  a  severity  to  and  including  the  95th  percentile  potentially  survivable  accident 
while  minimizing  aircraft  damage  to  the  maximum  extent  practical.  The  95th  percentile 
design  pulse  generally  means  that  the  loads  on  the  occupants  would  be  greater  in  only  5 
percent  of  the  accidents  but  would  still  be  within  the  defined  human  tolerance  limits. 
Table  2  presents  the  95th  percentile  potentially  survivable  crash  design  pulse  for  heli¬ 
copters  expressed  in  terms  of  impact  velocity  change  with  associated  minimum  attitude 
requirements.  It  should  be  noted  that  Table  2  and  some  of  the  subsequent  discussion 
reflect  criteria  that  are  proposed  for  the  revised  MIL-STD-1290  and  in  some  cases  deviate 
from  available  published  design  criteria.  This  approach  is  meant  to  enhance  the  validity 
and  usefulness  of  this  paper.  Perhaps  the  most  critical  MIL-STD-1290  factor  in  designing 
the  helicopter  for  crash  survivability  is  the  vertical  design  impact  velocity  change 
requirement.  Since  the  helicopter  spends  a  large  percentage  of  its  operational  life  in 

TABLE  2.  95TH  PERCENTILE  POTENTIALLY  SURVIVABLE  CRASH  IMPACT  DESIGN  CONDITIONS 


IMPACT  DIRECTION 
(AIRCRAFT  AXES) 

OBJECT 

IMPACTED 

VELOCITY  CHANGE 
(FT/SEC) 

_ 

MIL- 

STD-1290 

CURRENT 

PROPOSED  REVISION 

^ITCH 

ROLL 

YAW 

PITCH 

ROLL 

YAW 

Longitudinal 

Rigid 

Abutment 

(Cockpit) 

or 

Wall 

15 

Longitudinal 

Rigid 

Abutment 

(Cabin) 

or 

Wall 

40 

Longitudinal 

Rigid 

Surface 

50 

0 

0 

0 

-  5° 

+  10° 

0 

(Cockpit  4  Cabin) 

Vertical 

Rigid 

Surface 

42 

+  15° 

+  30° 

0 

+  15° 

+  10° 

0 

to 

Lateral 

Rigid 

Surface 

25 

-  5° 

Lateral 

Rigid 

Surface 

30 

Resultant  Vector* 

Rigid 

Surface 

50 

(a)  Light  fixed-wing  aircraft,  attack  and  cargo  helicopters. 

(b)  Other  helicopters. 

‘Note:  The  downward,  sideward,  and  forward  velocity  components  of  the  resultant  velocity 

vector  do  not  exceed  42,  .10,  and  50  ft/scc,  respectively. 


the  low-speed,  low-altitude  flight  regime,  accidents  predominantly  occur  with  high  ver¬ 
tical  descent  rates  and  with  the  aircraft  in  a  near  normal  attitude.  Thus,  the  aircraft 
must  withstand  vertical  impacts  of  42  ft 'sec,  within  the  aircraft  attitude  limits  of  +10 
degrees  roll  and  +15  degrees  to  -5  degrees  pitch,  (1)  with  no  more  than  a  15-percent 
reduction  in  the  height  of  the  cockpit  and  passenger/troop  compartments  and  (2)  without 
causing  the  occupants  to  experience  injurious  accelerative  loading.  This  is  a  good 
example  of  a  MIL-STD-1290  proposed  revision.  The  current  version  states  the  42-ft/sec 
requirement  for  an  aircraft  impact  attitude  within  +15  degrees  pitch  and  +30  degrees  roll, 
which  not  only  dictates  excessive  landing  gear  capability  but  does  not  represent  the 
typical  impact  as  derived  from  recent  analysis  of  accident  data.  Based  on  this  recent 
analysis  of  roll  and  pitch  frequencies  for  Army  helicopter  accidents  over  the  past  10 
years,  a  more  detailed  representation  of  the  vertical  crash  impact  conditions  has  been 
developed  and  is  being  proposed  as  a  MIL-STD-1290  revision  (see  Figure  1).  In  this  case 
pitch  and  roll  envelopes  are  specified  for  vertical  velocities  of  both  42  and  36  ft/sec. 


Figure  1.  Vertical  Impact  Design  Conditions  Envelope. 


Other  key  design  impact 
velocity  changes  are  shown  in 
Table  3.  The  landing  gear  shall 
provide  energy  absorption  capa¬ 
bility  to  reduce  the  vertical 
velocity  of  the  fuselage  as  much 
as  possible  under  the  crash  con¬ 
ditions.  As  a  minimum,  the 
landing  gear  shall  be  capable  of 
decelerating  the  aircraft  at 
normal  gross  weight  from  an 
impact  velocity  of  20  ft/sec 
onto  a  level  rigid  surface  within 
an  attitude  envelope  of  +10 
degrees  roll  and  +15  degrees  to 
-5  degrees  pitch  without  allowinq 
the  fuselage  to  contact  the 
ground  and  without  gear  pene¬ 
tration  into  an  occupied  area. 
Plastic  deformation  of  the  land¬ 
ing  qear  and  its  mounting  system 
is  acceptable  in  meeting  this 
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requirement;  however,  with  the  possible  TABLE  3.  ADDITIONAL  MI L-STD- 1 290  DESIGN 

exception  of  the  rotor  blades,  the  re-  REQUIREMENTS 

mainder  of  the  aircraft  structure  shall 
be  f 1 iqhtworthy  alter  impact.  The  nose 
section  of  the  helicopter  is  to  be  de¬ 
signed  to  preclude  earth  plowing  and 
scooping  tendencies  when  the  forward  25 
percent  of  the  fuselage  is  subjected  to 
a  longitudinal  load  uniformly  applied 
with  a  local  upward  load  of  10  C,s  and  a 
rearward  load  of  4  Gs.  The  fuselage 
shall  also  be  designed  for  rollover  pro¬ 
tection  and  shall  be  capable  of  sustain¬ 
ing  a  4  G  load  applied  uniformly  over 
the  fuselage  to  surface  contact  area  if 
rollover  occurs.  Finally,  all  high  mass 
items  which  would  pose  a  hazard  to  per¬ 
sonnel  during  a  crash  shall  be  designed  to  withstand  20  Gs  longitudinally,  20  Gs  vertically, 
and  18  Gs  laterally  when  applied  separately. 


Landing  Gear 


Plowing  4  Scooping 
Rol lover 

High  Mass  Tie-down 
(Applied  Separately) 


20  Ft/Sec,  +  10°  Roll  , 

+15°  to  -5°  Pitch 
No  Fuselage  Damage 

10  G  Up  4  4  G  Aft  on 
Fwd  25?  Fuselage 

4  G  Side  Load 
4  G  Roof  Load 

+  20  G  Longitudinal 
+  20  G/- 10  0  Vertical 
+  18  G  Lateral 


For  maximum  effectiveness,  design  for  crashworthiness  dictates  that  a  total  systems 
approach  be  used  and  that  the  designer  consider  survivability  issues  in  the  same  light  as 
other  key  design  considerations  such  as  weight,  load  factor,  and  fatigue  life  during  the 
initial  design  phase  of  the  helicopter.  Figure  2  depicts  the  system's  approach  required 
relative  to  management  ol  the  crash  energy  for  occupant  survival  for  the  95th  percentile 
vertical  crash  pulse  design  condition.  The  crash  G  loads  must  be  brought  to  within  human 
tolerance  limits  in  a  controlled  manner  to  prevent  injury  to  the  occupants;  this  can  be 
uccomp 1 i shod  by  using  the  landing  gear,  floor  structure,  and  seat  to  progressively  absorb 
most  of  the  crash  energy  during  the  crash  sequence.  Thus,  the  occupant  is  slowed  down  in  a 
controlled  manner  by  st roki nu /fai 1  inn  the  landing  gear,  crushing  the  floor  structure,  and 
stroking  the  seat  at  a  predetermined  load  before  being  subjected  to  the  crash  pulse  which 
by  then  has  been  reduced  to  within  human  tolerance  limits.  In  addition,  the  large  mass 
items  such  as  the  overhead  gearbox  are  slowed  down  by  stroking/failing  of  the  landing  gear 
or  fuselage  structure,  and  in  some  cases,  by  strokinu  of  the  gearbox  within  its  mounts. 

In  this  example,  assuming  that  the  landing  gear  has  been  designed  to  meet  the  minimum  re¬ 
quirements  of  MX L-STD- 1290,  i . e .  ,  20  ft, sec,  the  fuselage  would  be  decelerated  to  approxi¬ 
mately  17  ft  sec  at  the  time  of  contact  with  the  surface. 


Tile  Army's  most  recent  helicopters, 
the  U1I-60  BLACK  HAWK  and  All-64  APACHE, 
are  both  designed  generally  in  accord¬ 
ance  with  the  requirements  ot  MIL-STD- 
1290,  and  the  significant  payoff  for 
designing  these  aircraft  for  crash- 
worthiness  will  bo  addressed  later. 

The  preceding  discussion  should  not 
be  interpreted,  however,  to  imply  that 
nothing  can  be  done  for  existing  air¬ 
craft  systems.  Quite  the  contrary. 

Considerable  improvement  in  crashworthi¬ 
ness  can  be  achieved  on  existing  heli¬ 
copters  by  applying  such  features  as 
improved  crew  restraint  systems,  energy¬ 
absorbing  seats,  crash  tolerant  fuel 
systems,  and  breakaway  control  sticks. 

Also,  the  above  discussion  of  crashworthy  requirements  principally  addresses  the  air¬ 
frame,  the  main  objective  ol  which  is  to  provide  a  protective  shell  for  the  occupants  and 
to  allow  deformation  of  the  structure  in  a  controlled,  predictable  manner  to  minimize 
torces  on  the  occupants.  Other  key  requirements  in  MIL-STD-1290  in  designing  a  helicopter 
system  for  crashworthiness  include: 

.  Occupant  restraint  design--Seats  and  litters  shall  be  designed  to  retain  occupant 
position  during  crash  and  shall  contain  integral  means  of  crash  force  attenuation. 
Crew  seats  shall  be  designed  to  permit  the  seat  to  stroke  12  inches  vertically. 

The  immediate  surroundings  shall  be  designed  to  minimize  occupant  injury  when  body 
parts  flail  in  a  crash.  These  designs  shall  be  applicable  with  the  5th  through 
the  95th  percentile  male  aircrewman  (i.e.,  133-lb  thru  212-lb  crewman). 

.  Cargo  and  equipment  restraint  system  desiqn--The  desiqn  shall  provide  sufficient 
restraint  of  all  cargo  and  high  mass  equipment  in  all  directions  to  prevent  injury 
to  occupants  in  the  95th  percentile  survivable  accident. 

.  Postcrash  fire  prevention  design--All  flammable  fluid  systems  shall  be  designed  to 
minimize  spillage  of  fluids  durinq  and  after  survivable  crash  impacts,  and  when 
spillage  cannot  be  avoided,  the  system  shall  be  designed  to  prevent  ignition  of  the 
fluids  to  the  maximum  extent  practical. 

.  Postcrash  emergency  escape  provisions  design — The  design  shall  provide  for  suffi¬ 
cient  size  and  quantity  of  exits  to  allow  occupant  escape  within  30  seconds  after 
the  crash  sequence  is  over  (including  ditching)  even  when  half  of  the  exits  are 
blocked  off. 


CRASHWORTHY  R&D  PROGRAM  HIGHLIGHTS 


14-5 


Considerable  effort  has  been  accomplished  in  the  past  and  is  presently  ongoing  in  the 
area  of  helicopter  crashworthiness  research  and  development.  Efforts  include  such  diverse 
areas  as  human  tolerance  definition,  crashworthy  troop  and  crew  seats,  improved  restraint 
systems,  crashworthy  fuel  systems,  math  modeling  of  crashworthy  structures,  crashworthy 
composite  structures,  and  full-scale  crash  testing  of  both  crashworthy  and  noncrashworthy 
aircraft.  Results  of  these  efforts  are  applicable  to  both  the  retrofit  of  existing  air¬ 
craft  systems,  to  improve  their  survivabi 1 i ty /mission  capability,  and  to  the  definition  of 
design  criteria  and  publication  of  specifications  and  standards  for  crashworthy  design  of 
new  systems.  Highlights  of  key  crashworthy  RS.D  programs  within  the  US  Army  are  presented 
in  the  following  paragraphs. 

Crash  Impact  Characteristics  of  Helicopter  Composite  Structures 

In  recent  years,  composite  materials  such  as  graphite,  fiberglass,  boron  and  Kevlar 
have  been  used  more  extensively  in  the  design  of  structural  and  nonstructural  aircraft 
components  due  to  their  potential  for  cost  and  weight  savings.  Entire  composite  airframes 
have  already  been  produced  for  general  aviation  fixed-wing  aircraft.  It  is  therefore 
reasonable  to  assume  that  in  the  near  future  the  helicopter  industry  will  be  producing 
large  numbers  of  aircraft  with  major  structural  components,  such  as  the  fuselage,  wings, 
empennaqe,  blades,  and  landing  qear,  constructed  of  composite  materials.  In  view  of  the 
crashworthiness  requirements  specified  in  MIL-STD-1290,  it  was  considered  particularly 
appropriate  during  the  early  stage  of  application  of  composite  materials  to  helicopter 
structures  to  investigate  their  crash  impact  behavior.  When  applying  composites  to  a 
crashworthy  airframe  structure,  entirely  different  design  concepts  may  be  required  than 
are  used  with  conventional  metal  structures.  Composite  materials  exhibit  low  strain-to- 
failure  compared  to  such  metals  as  2024  aluminum,  a  ductile  metal  that  can  tolerate  rather 
large  strains,  deform  plastically,  and  absorb  a  considerable  amount  of  energy  without 
fracture.  Because  of  this  difference  between  composites  and  metals,  crash  energy  absorp¬ 
tion  with  composites  will  not  come  through  material  stress-strain  behavior  as  it  did  with 
metals,  but  rather  through  innovative  design. 

To  determine  the  crashworthiness  characteristics  of  helicopter  composite  structures, 
a  program  was  conducted  for  the  design,  fabrication,  design  support  testing,  analysis  and 
crash  testing  of  two  full-scale  composite  helicopter  cabin  sections.  Crash  tests  were 
conducted  for  0-  and  20-degree  roll  impact  attitudes  at  a  vertical  impact  velocity  of 
30  ft/sec,  which  is  representative  of  the  Army's  vertical  impact  velocity  requirement 
(MIL-STD-1290)  for  noninjurious  loadings  if  the  landing  gear  is  assumed  to  absorb  approxi¬ 
mately  one-half  the  impact  energy. 
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The  cabin  section  (Figure  3) 
had  three  major  bulkheads:  the 
forward  crew  bulkhead,  the  aft 
cabin  bulkhead,  and  the  aft  fuel 
cell  bulkhead.  The  masses  in  the 
cabin  were  a  1000-pound  overhead 
transmission  mass,  1100  pounds  of 
fuel,  two  167-pound  passenger 
masses,  and  two  200-pound  forward 
crew  masses.  Located  directly 
beneath  the  forward  crew  bulkhead 
and  the  aft  two  bulkheads  was  a 
crushable  cabin  subfloor  structure 
designed  to  absorb  energy  and  con¬ 
trol  loads  to  the  primary  protec¬ 
tive  shell.  Between  the  crush 
zones  was  frangible  structure  that 
would  crush  out  of  the  way  without 
damaging  the  floor  structure. 


ENERGY-ABSORBING  AREAS 


KEVLAR/EPOXY  SUBFLOOR 
STRUCTURE  WITH 
SANDWICH  USED  IN 
ENERGY-ABSORBING 
AREAS 


Figure  3.  Composite  Cabin  Test  Section  Design  Features. 


Kevlar,  fiberglass,  and 
graphite/epoxy  materials  were  used 
in  constructing  the  cabin  section. 
Fiberglass  sandwich  construction 
was  used  in  the  bulkheads  and 
floor  panel,  and  in  portions  of 
the  upper  roof  structure.  Kevlar 
was  used  in  the  roof,  belly  and 
side  skins,  and  in  the  energy-absorbing  subfloor  structure.  Graphite  reinforcement  was  used 
around  the  door  frame  and  in  the  main  roof  beams.  Figure  4  depicts  the  cabin  components. 

For  the  first  test,  two  stroking  seats  equipped  with  wire-roller  attenuators  were  installed 
in  the  cabin.  The  rig.it  seat  was  floor-mounted  and  the  left  seat  was  bulkhead-mounted. 
Fiftieth  percentile  Part  972,  Hybrid  II  anthropomorphic  testing  dummies  were  placed  in  the 
seats.  The  impact  was  on  a  simulated  rigid  surface  comprised  of  steel  plates  over  a  sand 
base.  Instrumentation  included  accelerometers  on  major  masses  and  important  structural 
locations,  and  high-speed  motion  picture  cameras  were  used  to  record  the  structure  response 
and  failure  modes.  The  level  attitude  30  ft/sec  vertical  velocity  (or  about  14  feet  free 
fall  height)  composite  cabin  section  drop  test  was  survivable  based  on  the  excellent  post¬ 
test  condition  of  the  cabin  protective  shell  structure  and  the  performance  of  the  energy- 
absorbing  structure  components  (see  Fiqure  5).  There  was  approximately  4  inches  of  sub¬ 
floor  crush.  The  bulkhead-mounted  left  seat  stroked  9  inches  and  the  f loor-mounted  right 
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ed  to  the  dummy.  Both  seats  had  an  11 -inch  stroke 
y  ap.xi  therefore  did  not  bottom  out.  The  10 00 -pound 
transmission  mass  st  joked  abeut  1.2ci  inches  in  tile* 
designed  roof  beam  attachment  joints. 


The  second  cabin  section  was  equipped  with  lumped  masses 
or  the  passonuors  in  lieu  of  stroking  seats  and  dummies.  This 
ms  done  in  order  to  reduce  the  complexity  of  the  test  specimen 
.a  the  severe  20-deureo  mil  impact  condition.  Dunmi  the  test 
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Figure  5.  Fl.it  Drop  Tost. 

KRASH  dynamic  analysis  for  major  mass  items  such  as  the  crew,  troops,  fuel,  and  trans¬ 
mission  and  were  applied  to  the  NASTRAN  finite  element  model  of  the  cabin  section.  To 
addition,  the  crush  zone  loads  were  applied  to  the  floor.  The  NASTRAN  model  was  then  used 
to  develop  internal  loads  to  be  used  for  the  strength  analysis.  Critical  a>  -as  in  the 
primary  structure  components  were  sized  usinq  the  internal  loads  from  the  NASTRAN  mode. 

Some  of  the  important  critical  areas  were  the  main  roof  beams  that  support  the  transmission 
mass,  the  aft  cabin  bulkhead,  the  roof  and  side  skins,  and  the  floor  panel  loaded  by  the 
fuel  mass.  The  crushable  subfloor  structure  was  sized  based  on  design  support  testing  data 
to  get  the  proper  energy  absorption  and  control  of  loads  to  the  primary  protective  shell 
structure.  As  a  result  of  this  research,  it  was  concluded  that: 


MIL-STD-1290  crashworthiness  requirements  can  be  met  with  a  composite  fuselage 
structure  if  designed  with  energy  absorption  and  load  attenuation  in  controlled 


The  use  of  design  support  testing  to  size  and  optimize  the  load  deflection 
characteristics  of  composite  material  energy-absorbing  components  is  an 
accurate,  economical  approach. 

.  The  KRASH  (supplemented  with  NASTRAN)  and  the  PYCAST  nonlinear,  large-deflection 
structure  crash  simulation  computer  programs  can  be  useful  and  reasonably  accurate 
analytical  tools  for  designing  the  crashworthy  composite  fuselage  cabin  sections. 

Additional  details  on  this  program  are  provided  in  Reference  4. 
human  Tolerance 


A  major  objective  of  Army  crashworthiness  is  to  attenuate  crash  loads  reaching  the 
occupants  to  levels  within  the  limits  of  human  tolerance.  To  properly  design  to  meet  this 

objective,  limits  of  human  tolerance  to  acceleration 
.  about  all  aircraft  axes  must  be  accurately  defined. 

|  This  is  an  extremely  difficult  set  of  data  to 

-  -  2 '  msec  i :  i  )  ;  obtain  since  human  tolerance  to  impact  forces  varies 

\  appreciably  with  an  individual's  me,  sex,  weight 
-  -  t*  :•  sec  ::»civ:s>  ;  distribution,  and.  general  state  of  health.  Army 

.  -A*  t  cabin  :  ■:  i  helicopters  car,  normally  bo  expected  to  be  occupied 

by  personnel  who  are  younger  and  in  bettor  physical 

I  lip,  j  ]  condition  than  that  of  the  general  population 

- 1  II  — -  j  for  which  most  of  the  tolerance  data  have  been 

II  ^  bidt  uun’::y  pelvis  j  developed  to  date.  Thus,  a  degree  of  conservatism. 

\x  .  j  may  be  built  in  for  the  military  in  using  criteria 

\a  l\  ]  developed  from  a  "general  public"  cross  section. 

I  l  i'V  j  However,  these  tolerance  criteria  have  for  the  most 

■  ~  1  II  %/*  —  -  «  part  been  based  on  experiments  involving  subjects 

V  j  seated  with  a  "correct"  upright  posture,  while  Army 

!  aviators  spend  largo  portions  of  their  time  while 
!  in  the  aircraft  in  less- than- i doa 1  postures  for 
;  absorbing  crash  impact  (e.g.,  viewing  through  target 
j  designating /sighting  scopes).  During  nap-of-the- 

-  - . - — - - - —  earth  flight  operations,  a  crewman  can  expect  little 

‘Pimc  Seconds)  warning  of  an  impending  crash  impact  and.  will  vir¬ 

tually  have  no  time  for  assunim  a  proper  pro- impact 

P  i  .111  \  V*  »-  t  i  r*  1  A ,  1  nr.n  (■  i  nn  T  I  ip.i_  i  C.  .j  t  UTC  . 


F i g  u  re  6 .  Vertical  Acce 1 c r a t i o n  T i mo - 

History  of  Left  Troop  Seat  ^ 

r., _  i  ^  i  i  '  y.  ...  „  With  proper  restraint,  aircraft  occupants  can 

Dummy  Pe  lv  i  s  and  I-  looi  Toi  .  .  .  .  ,  n  r  ,  ,  ,  .  ,  ■  .  .  . 

Flit  Im-’ict  withstand  the  full  95th  percentile  survivable  crash 

acceleration  conditions  in  the  lateral  (0V)  and 
longitudinal  (0X)  directions  with  no  energy 

absorption.  Such  is  not  the  case  with  accelerations  directed  along  the  vertical  axis,  par¬ 
ticularly  headward  (+('z)  acce  lerat  ion .  The  lumbar  vertebrae  of  the  occupant,  which  must 
support  most  of  the  upper  torso  loaded  as  a  column,  are  susceptible  to  compression  fracture 
with  attendant  injuries  such  as  paralysis.  To  prevent  the  occupant  from  experiencing  inju¬ 
rious  accelerative  loadings,  energy  attenuation,  in  the  form  of  energy-absorbing  landing 
gear,  crushable  belly  structure,  and.  stroking  seats,  is  required  to  control  vertical  loads. 
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Figure  7.  Twen tv-Pcg ree  Poll  Prom  Test. 


Current  Army  criteria  arc  based  on  the  riband’  human  tolerance  data  for  the  upper 
limit  of  tolerable  (with  no  injury)  .ir^olorntion  in  the  *-C,~  direction  (see  Figure  8). 

These  data  establish  the  upper  limit  for  vertical  acceleration  excursions  transmitted  to 
the  occupant  to  magnitudes  of  less  than  21  ('  for  time  durations  exceeding  6  m i 1 1 i seconds . 
The  Army  crashworthy  crewsoat  speci f icat ion ,  MlI,-F-r>R09K>6 ,  has  placed  this  limitation  on 
the  seat  pan  acce  lerat  ions  whilf^  the  seat  i  r  subjected  to  dynamic  testing  defined  in 
Figure  9.  In  seat  tests  conducted  since  the  spec i f i ca t i on  was  established  in  1971,  a 
characteristic  curve  (Figure  10)  shows  that  tlv  seat  pan  deceleration  rises  sharply  during 
the  onset  of  the  input  pulse,  then  drops  rapidjy  as  the  seat  becomes  fully  coupled  to  the 
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occupant.  The  deceleration  may 
actually  pass  through  zero  (con¬ 
stant  velocity)  as  this  event 
occurs.  The  deceleration  then 
rises  sharply  and  forms  a  sec¬ 
ondary  spike  before  damping  out 
around  tne  load  factor  used  in 
the  design  of  the  seat  energy¬ 
absorbing  system.  The  primary 
seat  pan  deceleration  spike  is 
of  little  concern  since  it  rep¬ 
resents  the  response  of  the 
unloaded  seat  to  the  impact 
event.  The  secondary  spike, 
however,  occurs  after  the  seat 
cushion  and  buttocks  have  com¬ 
pressed  and,  in  most  tests, 
its  duration  above  23  C 
exceeds  the  Eiband  injury  cri¬ 
teria.  The  body  is  a  complex 
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Figure  8.  Maximum  Acceptable  Vertical  Pulse  Acceleration 
and  Duration  Values. 


dynamic  system  when  one  considers  the  pelvis,  chest  and  head  as  masses  being  intercon¬ 
nected  by  flesh  and  spinal  column  "springs."  Whether  the  character istic  secondary  spike 
indeed  applies  injurious  loads  to  any  part  of  the  spine  is  still  largely  unknown.  Accord¬ 
ingly,  research  is  being  conducted  to  better  define  human  tolerance  to  injury  as  related 
to  the  typical  Army  aviator.  This  includes  advanced  energy  absorber  research  and  research 
involving  cadaver  testing. 


F igure  9.  Dynamic  Test  Conditions  for 
Aircraft  Seats  . 

Since  miil-1979,  the  Army  has  been  jointly  involved  with  its  sister  services  and  the 
FAA  in  sponsoring  tests  to  establish  the  threshold  of  human  tolerance  to  spinal  compres¬ 
sive  loads.  Testing  has  been  performed  at  the  Wayi.o  State  University  Hi oong moor ing 
Center  on  their  WHAM  III  (Wayne  Horizontal  Accelerator  Mechanism)  sled.  This  testing  has 
involved  the  use  of  human  cadavers  in  both  rigid  (nonstroking)  seats  and  the  production 
BLACK  HAWK  helicopter  crashworthy  erewseat .  Tests  of  throe  embalmed  cadavers  in  the  rigid, 
seat  gave  nixed  results,  with  spinal  fractures  occurring  at  7 . 3  C, ,  28.3  C,  and  13.0  n. 
Those  results  were  achieved  by  testing  each  cadaver  to  progressively  higher  peak  impact  d 
leading  with  the  impact  vector  being  parallel  to  his  spine.  X-rays  were  taken  between 
runs  until  a  spinal  fracture  wis  indicated.  Table  4  summarizes  t  lie  results  tor  these 
three  tests. 

An  unemba  1  mod  cadaver  test  set  i  os  is  present  ly  onjoinn  using  the  BLACK  HAWK  crewseat. 
having  a  12-  to  17-inch  stroking  capability  depending  on  seat  height  ad  rustnent  .  This 
testing  has  been  performed  w  l  t  h  two  seat  orientations:  one  to  simulate  a  "Mat"  or 
0-degree  pitch  angle  BLACK  HAWK  gjoun!  impact  tieterred  to  as.  the  "vertical"  mode'  ami 
another  to  simulate  a  10-degree  nose-down  BLACK  HAWK  ground  impact  ireforred  to  as  the 
"combined  axis"  node).  Tht  sled  impact,  pulse  has  approximated  a  41  C.  triangular  pulse  el 
84  mi  1 1 i seconds  duration  tor  a  velocity  change  ot  4  2  tt  sec.  Tins  is  repr esent at i ve  of 
the  Army's  93th  percentile  potentially  survivahle  impact.  Testing  has  been  conducted 
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TAB L K  4.  SUMMARY  OF  TFST  CONDITIONS  FOR  RIGID  SEAT  TESTS  WITH  EMBALMED  CADAVERS 


CADAVER 

WEIGHT 

PEAK 

-  -  -  -  -  , 

TEST  NO. 

NO. 

ACE 

HEIGHT 

(LB) 

SEX 

ACCEL.  (G) 

FRACTURE  CONDITION  ’ 

SERIES  41 

4812 

5  2 

5 1  10" 

161 

M 

•C* 

O'* 

CD 

29  -V  7.5  G  ! 

lit  RUNS) 

i 

SERIES  «2 

4644 

49 

5 1  7" 

202 

\\ 

4  TO  10 

T 1 0  S.  Til  J  2  8.5  G , 

(11  RUNS) 

COM P R ESS  I O N  FAILURE  j 

SERIES  s.3 

•16  60 

51 

•:>  ’  7 " 

216 

M 

4  TO  3  0 

T8  a  It  G,  ANTERIOR  ; 

(8  RUNS ) 

with  se.it  energy  attenuators  lEA's)  set  for  14.5,  11.5,  an.!  8.5  O  str  Kir.  :  loads  based  or. 
a  40th  percent  vie  seat  eccupant.  Table  5  lists  pertinent  .lata  relatm:  •  .  each  test  in 
this  series  with  cadaver  injury  condition  determined  by  j  ost-tost  autopsy. 


TABLE  r 

SUMMARY  O F  TES"’ 

CON'D  ITU 

-’NS  :• 

OR  LTi-GOA 

-  HEWS FAT 

TESTS  W 

ITIi  1-NLMhALMED  CADAVER? 

TEST 

NO. 

TEST  IMPACT 

CONDITION  MODE 

ACE 

SEX  III 

:iGin 

WEIGHT 

ILH) 

INPUT 
7ELOC I  TV 
CHANCE 
(ET-SECM 

INPUT 
PEAK 
ACCEI. . 

fOC 

VERTEBRAL 

I  NO CRY  CONDITION 

AF020 

14.5  G  •:  A  VERT 

44  E  5 

V 

166 

4  1  .  5 

4  3.4 

NO-IE 

AF02  1 

14.5  .1  F  A  COMB 

4  4  V  5 

3  " 

166 

42. 6 

44.4 

T 1 2  FND  PLATE,  Cl -02 
ARTICULATION 

AF0  2  5 

14.5  G  E  A  VERT 

5  5  M  5 

" 

160 

- 

Ls  anterior  weix;e 
: '  KACTURE 

AF028 

14.5  G  Li  A  VKKT 

f  1  F  5 

4" 

14  0 

4  5.r- 

4  .1.2 

NONE  * 

/V0  2  9 

14.5  G  E  A  COM!-- 

6  ]  I ' 

4" 

i  40 

44.0 

4  2.4 

T 1  2  ,  ANTERb. 'i<  WI  i‘*  *?' 

AF0.31 

.4.5  G  E  A  VERT 

6.3  r  5 

5  V 

1  4  8 

•1  !  .  1'- 

34.8 

T8 ,  COM!  RE?? I ON  FRACTURE; 

AF0  13 

i  I  .  :>  C  K  A  C'  'Mi • 

5  2  M 

" 

2  i  8 

4  1.8 

4  5.0 

LI,  ANTFKI  WKlVi- 

f  R.  tt.  r ..  ft 

AF0  1 5 

!1.5  '  i:  A  C- IMF 

i>  3  M  5 

8  " 

1  4  1 

44  .  ' 

4  0 . 5 

L 3 ,  ANTERIOR  WEpCE  i 

FRACTURE 

A:  ‘  0  r 
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studies,  much  work  remains  in  establishing  human  tolerance  levels  from  cadaveric  data. 
Crashworthy  Seat  Design  Criteria 

In  addition  to  crashworthy  armored  crewseats  in  the  Army's  UH-60  and  AH-64  helicopters, 
lightweight  crashworthy  troop  seats  have  been  developed  and  are  installed  in  the  cargo/troop 
compartment  of  the  UH-60.  These  seats  are  constructed  of  tubing  covered  with  fabric  and  are 
ceiling-suspended  and  floor-stabilized  to  provide  energy  attenuation  in  the  vertical, 
forward  and  lateral  directions.  A  compact  wire-bending  attenuator  is  used  for  vertical  im¬ 
pact  loads  and  a  four-point  restraint  system  having  a  single  release  buckle  is  attached  to 
the  seat.  These  troop  seats,  weighing  approximately  18  pounds  each,  have  quick  disconnect 
fittings  allowing  for  quick  conversion  of  the  aircraft  to  carry  cargo. 

Because  of  the  need  to  develop  improved  criteria  for  the  load-deflection  characteristics 
of  crashworthy  seat  energy  absorbers ,  an  extensive  test  program  was  initiated  by  the  Army 
with  joint  participation  by  the  FAA's  Civil  Aeromedical  Institute  (CAMI)  and  the  Naval  Air 
Development  Center  (NADC) .  A  matrix  of  59  dynamic  impact  tests  were  conducted  using  a  pro¬ 
duction  US  Army  BLACK  HAWK  helicopter  crewseat  as  a  baseline.  Variables  that  were  investi¬ 
gated  included  the  shape,  magnitude,  and  rate  of  onset  of  the  input  deceleration  pulse;  the 
velocity  change;  the  type  and  size  of  the  anthropomorphic  dummy;  the  energy  absorber  limit 
load;  the  movable  seat  weight;  the  seat  cushion  characteristics  and  orientation  to  the  input 
pulse;  and  the  structural  spring  rate  of  the  seat.  Simula,  Inc.,  provided  test  support, 
data  reduction  and  analysis,  and  correlation  of  results  with  computer  program  SOM-LA  (Seat/ 
Occupant  Model  -  Light  Aircraft) .  Testing  was  conducted  at  CAMI  (47  tests) ,  NADC  (9  tests) , 
and  Simula,  Inc.  (3  tests)  to  assess  the  effects  on  dynamic  response  of  each  test  facility's 
unique  input  pulse  shape.  Figure  11  shows  baseline  42  G  input  pulses  produced  by  each  test 
facility  compared  to  the  idealized  prescribed  triangular  pulse. 

Though  space  limitations  do  not  permit  the  re¬ 
lating  of  results  of  each  parametric  variable,  impor¬ 
tant  relationships  and  sensitivities  were  established. 

For  example,  tests  with  "ramped"  energy  absorbers, 
whose  loads  increased  throughout  the  seat  stroke, 
revealed  that  they  performed  less  efficiently  than 
conventional  square-wave  type  devices.  The  ramped 
devices  caused  the  dummy  to  utilize  more  than  1.5 
inches  of  additional  stroke,  while  the  measured  ac¬ 
celerations  and  calculated  dynamic  response  indices 
(DRI's)  were  actually  higher.  The  dynamic  response 
index  is  a  dimensionless  parameter  resulting  from  a 
single  lumped-mass,  damped-sprinq  model  of  the  body 
mass  acting  on  the  human  spine.  It  represents  the 
human  response  to  short-duration  accelerations  applied 
in  an  upward  vertical  direction  parallel  to  the  spine. 

The  US  Air  Force  uses  DRI  as  one  of  its  ejection  seat 
acceptance  parameters. 

Another  significant  test  series,  sponsored  by  the 
US  Army  Aeromedical  Research  Laboratory  (USAARL) ,  con¬ 
tributed  to  the  overall  interpretation  of  data  ob¬ 
tained  from  all  of  these  test  programs.  A  50th  per¬ 
centile  (Part  572)  anthropomorphic  dummy  and  a  95th 
percentile  (VIP-95)  dummy  were  modified  to  install  a 
six-axis  load  cell  at  the  base  of  their  lumbar  spines. 

The  VIP-95  also  received  a  six-axis  cervical  load  cell. 

The  dummies  were  then  subjected  to  several  dynamic 
impact  tests  at  CAMI,  some  of  which  duplicated  earlier 

test  conditions.  Results  indicated  that  direct  meas-  Figure  11.  Typical  Baseline  Decel- 
urement  of  spinal  loads  in  this  fashion  may  provide  a  eration  Pulses  Compared 

better  standard  for  judging  crashworthy  seat  injury  to  Idealized  Pulse, 

criteria.  More  work  needs  to  be  done  in  order  to 

achieve  a  noninterfering  load  cell  installation,  since  duplicative  test  conditions  revealed 
some  changes  in  the  modified  dummy  dynamic  behavior.  Reference  7  reports  results  under  this 
effort  and  includes  recommendations  for  future  crashworthy  seat  specification  updating. 

Restraint  System 

The  occupant  restraint  system  is  literally  the  "first  line  of  defense"  in  preventing 
aircraft  crash  injuries.  This  system  includes  not  only  the  belted  occupant  restraint  but 
also  a  properly  engineered  mounting  of  the  seat  in  the  aircraft.  This  combination  keeps 
the  occupant  from  becoming  a  flying  missile  during  the  crash  sequence.  MIL-S-58095  has 
been  the  Army's  crashworthy  pilot/copilot  seat  and  restraint  system  criteria  document 
since  1971.  A  five-strap  belted  restraint  is  required  consisting  of  the  lap  belts,  two 
shoulder  straps  with  an  inertia  reel,  a  negative  G  strap,  and  a  single  point  of  attachment 
buckle.  The  negative  G  strap  is  permanently  affixed  to  the  buckle  and  requires  use  at  all 
times  to  ensure  against  occupant  submarining  under  the  lap  belt. 

The  compactness  of  today's  cockpit  and  the  close  proximity  of  mission  equipment  pose 
serious  crash  impact  hazards  to  the  aircrew.  Although  not  desirable  from  a  crashworthiness 
standpoint,  operational  considerations  dictate  that  mission  equipment  and  structure  be 
located  within  the  occupant's  crash  impact  motion  envelope.  Given  this  situation,  it  is 
critical  to  the  occupant's  crash  impact  survival  chances  that  he  be  provided  with  a 
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restraint  system  that  minimizes  his  crash  impact  motion  envelope,  particularly  con¬ 
cerning  his  head. 


During  1979,  the  Army  tested  seven  types  of  pilot/copilot  restraint  systems  under 
dynamic  impact  conditions  representative  of  various  degrees  of  survivable  crash  conditions. 
Thirty-three  dynamic  impact  sled  tests  were  performed  using  a  95th  percentile  anthropomor¬ 
phic  dummy  as  the  occupant.  Restraints  tested  represented  a  cross  section  of  those  cur¬ 
rently  available  with  features  such  as  a  reflected  strap  shoulder  harness  and  power  haul- 
back  inertia  reels.  Another  concept  tested  was  a  joint  Army/Navy  modification  to  the 
MIL-S-58095  restraint  called  the  Inflatable  Body  and  Head  Restraint  System  (1BAHRS) ,  which 
capitalizes  on  automotive  air-bag  technology  to  better  restrain  the  occupant  in  severe 
impacts.  This  system  (Figure  12)  uses  an  airframe-mounted  crash  sensor  to  identify  a  crash 
condition  and  then  trigger  the  inflation  of  air  bags  sewn  into  each  shoulder  harness.  In¬ 
flation  is  accomplished  by  a  solid  propellant  gas  generator  within  approximately  25 

milliseconds  from  being  triggered, 
and  the  air  bags  remain  inflated  for 
approximately  1*5  seconds.  The  in¬ 
flated  bags  act  to  tighten  the 
restraint  about  the  crewman,  better 
distribute  the  decelerative  loads 
over  his  upper  torso,  and  decrease 
head  and  neck  rotation.  Figures 
13  and  14  depict  the  reduction  in 
strike  envelope  determined  experi¬ 
mentally  during  the  1979  Army  tests. 
Figure  13  is  for  the  conventional 
MIL-S-58095  restraint  and  Figure  14 
shows  the  improvements  when  using 
the  IBAHRS .  Both  tests  were  con¬ 
ducted  at  the  95th  percentile  poten¬ 
tially  survivable  crash  pulse. 

Results  on  this  complete  test  series 
are  reported  in  Reference  8. 

The  activating  crash  sensor  for 
the  IBAHRS  must  be  tailored  for  the 
particular  aircraft  application,  and 
it  must  not  allow  triggering  during 
routine  flight  maneuvers  or  from 
vibratory  or  gust  loads  or  hard 
(autorotative)  landings.  The  crash 
sensor  threshold  accelerations  for 
the  Army's  AH-64  attack  aircraft  are 
shown  in  Figure  15  (from  Reference  9) 
for  G  loadings  directed  along  the  vertical  and  longitudinal  axes.  It  is  obvious,  however, 
that  each  aircraft  type  and  mission  scenario  would  have  to  be  examined  carefully  before 
selecting  the  crash  sensor  characteristics  for  an  IBAHRS.  For  example,  an  aircraft  with  6  G 
sustained  turn  capability  could  not  use  the  AH-64  crash  sensor. 


NORMAL 


INFLATED 


Figure  12.  Inflatable  Body  and  Head  Restraint 
System  (IBAHRS). 
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Figure  13.  AH-64  Copilot/Gunner  Strike  Figure  14.  AH-64  Copilot/Gunner  Strike 

Envelope  With  MIL-S-58095  Envelope  With  IBAHRS. 

Restraint. 

The  IBAHRS  is  currently  proceeding  through  detailed  engineering  development  tests. 

It  will  become  the  standard  restraint  system  for  the  AH-64  and  AH-1S  attack  helicopters 
after  production  approval  is  given. 

Crashworthy  Cyclic  Control  Stick 

The  floor-mounted,  rigid  cyclic  stick  has  been  a  cockpit  strike  hasard  for  many  years. 
It  has  been  a  major  contributor  to  scores  of  head  injuries  and  fatalities.  A  survey  of 
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Army  accidents  involving  4550 
occupants  indicates  that  over 
36  percent  of  the  456  fatali¬ 
ties  were  due  to  head  and  face 
injuries  (Reference  2,  Vol.  II). 

In  1982  the  US  Army  initi¬ 
ated  a  research  effort  to 
develop  a  cyclic  control  stick 
capable  of  meeting  the  military 
specification  requirements  for 
normal  and  emergency  control 
loads  as  well  as  having  break¬ 
away/telescoping  characteris¬ 
tics  when  struck  from  above  by 
the  crewman  in  a  hard  landing/ 
crash.  The  design  is  to  be 
generic  for  retrofit  in  both 
the  AH-1  and  UH-60' aircraft . 

The  vertical  separation/ 
collapsing  load  will  be  100- 
150  pounds,  which  is  within 
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Figure  15.  AH-64  IBAHRS  Crash  Sensor  Thresholds. 


human  tolerance  for  head  and  face  contact,  based  on  a  1  square  inch  contact  area.  A  grip 
with  4-inch  height  adjustment  range  is  also  to  be  incorporated,  which  is  a  feature  that 
is  not  present  on  existing  models. 


Whatever  the  nature  of  the  prototype  cyclic  stick  design,  it  must  first  be  structur¬ 
ally  capable  of  controlling  the  aircraft  under  all  conditions.  Static  pull  testing  will 
be  performed  on  the  prototype  model  to  assure  that  a  minimum  of  200  pounds  fore/aft  load 
and  100  pounds  lateral  load  can  be  withstood.  Dynamic  tests  will  then  be  performed  to 
determine  vertical  breakaway  loads  and  corresponding  reactive  head  accelerations  -for  the 
current  production  sticks  and  the  prototype  model.  These  will  consist  of  simple  pendulum 
tests  with  the  mass  and  texture  of  the  human  head  to  be  simulated  at  the  striking  end. 
Stick  impact  strike  velocities  of  30  and  20  ft/sec  have  been  predicted  by  program  SOM-LA 
for  95th  and  50th  percentile  male  occupants,  respectively.  The  pendulum  testing  will  be 
conducted  using  these  impact  velocities. 

In  future  aviation  weapon  systems  development,  it  is  likely  that  advanced  control 
systems  will  incorporate  sidearm  controllers  and  thus  effectively  eliminate  the  conven¬ 
tional  cyclic  stick  as  a  cockpit  strike  hazard.  In  the  meantime,  retrofit  of  a  well- 
designed  crashworthy  stick  may  be  a  very  cost-effective  approach  to  eliminating  a  major 
cause  of  crewman  injuries  and  fatalities. 

Advanced  Crashworthy  Landing  Gear 

Load-limiting  landing  gear  are  essential  to  accomplishing  crashworthiness  goals. 

From  purely  an  economic  viewpoint,  the  payoff  from  design  for  crashworthiness  is  primarily 
from  reduction  of  aircraft  mishaps,  thus  enhancing  mission  effectiveness  through  greater 
aircraft  availability  and  avoidance  of  mishap  costs.  The  MIL-STD-1290  requirement  that 
the  landing  gear  prevent  fuselage/ground  contact  for  impact  velocities  of  at  least  20  ft/ 
sec  for  +10  degrees  roll  and  +15  degrees  to  -5  degrees  pitch  attitude,  and  combinations 
thereof,  is  the  most  significant  factor  in  the  realization  of  a  cost-effective  return  on 
investment  of  design  for  crashworthiness.  A  landing  gear  that  will  prevent  fuselage/ 
ground  contact  at  higher  impacts  than  20  ft/sec  is  certainly  desirable  from  an  aircraft 
deunage  prevention  standpoint;  however,  this  capability  must  take  into  account  potential 
adverse  system  effects  such  as: 

.  Excessive  landing  gear  and  attachment  weight  with  attendant  decrease  in  aircraft 
performance 

.  Insufficient  injury  reducing  energy  attenuation  in  aircraft  structure  and  seats 
for  the  case  of  impact  with  a  retractable  crashworthy  gear  in  the  retracted 
position 

.  A  design  that  will  result  in  excessive  damage  to  dynamic  components  during 
landing  gear  load  attenuation  (This  may  be  especially  critical  for  the  tilt 
prop/rotor  concept.) 

The  required  roll  and  pitch  attitudes  for  impact  without  fuselage/ground  contact 
evolved  from  a  review  of  the  survivable  and  partially  survivable  US  Army  rotary-wing 
accidents  from  January  1972  to  December  1982.  Figure  16  shows  the  roll  frequency  of 
occurrence  when  only  impacts  of  +25  degrees  roll  or  less  are  considered  (74  percent  of 
all  accidents).  Figure  17  shows  the  pitch  frequency  of  occurrence  when  only  impacts  of 
+  30  degrees  pitch  or  less  are  considered  (92  percent  of  all  accidents). 

Although  the  AH-64  APACHE  has  entered  limited  production,  the  only  fully  operational 
helicopter  with  landing  gear  designed  to  the  criteria  of  MIL-STD-1290  is  the  UH-60A  BLACK 
HAWK.  This  landing  gear  configuration  shown  in  Figure  18  consists  of  a  main  and  tail 
gear,  each  having  two  stages  and  a  trailing  arm  for  increased  stability  during  impacts 
with  a  longitudinal  velocity  component.  The  first  stage  comes  into  play  for  normal  land¬ 
ings  and  hard  landings  up  to  20  ft/sec.  The  second  stage  contributes  to  the  total  system 
energy  absorption  during  crash  impacts  at  vertical  velocities  up  to  42  ft/sec. 
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Figure  18.  UH-60A  Landing  Gear 


Figure  16.  Impact  Roll  Angle  Frequency.  Figure  17.  Impact  Pitch  Angle  Frequency  . 

Additional  research  is  underway 
to  critically  analyze  crashworthiness 
design  criteria  in  light  of  cost  and 
aircraft  performance  effects  when  one 
considers  new-generation  aircraft  that 
may  have  retractable  landing  gear  con¬ 
sisting  of  composite  as  well  as  metal 
components.  The  emergence  of  new  high 
performance  aircraft  such  as  the  tilt 
prop/rotor  which  has  a  higher  disc 
loading  than  conventional  helicopters 
may  dictate  the  need  for  new  landing 
gear  design  criteria. 

Using  accident  rates  and  mean  loss 
data  furnished  by  the  US  Army  Safety 
Center,  an  assessment  was  made  of  the 
benefits  of  incorporating  into  the 
AH-64  a  landing  gear  capable  of  pre¬ 
venting  fuselage-ground  impact  for 
vertical  sink  rates  up  to  20  ft/sec  as 
compared  with  using  a  skid  gear  compa¬ 
rable  to  those  of  the  AH-1,  UH-1,  and 
OH-58  helicopters.  For  an  AH-64  fleet 
size  of  500,  it  was  calculated  that  there  would  be  a  14-percent  reduction  in  the  accident 
rate,  representing  an  estimated  savings  of  nearly  570  million  dollars  for  a  20-year  fleet 
life  cycle. 

Crashworthy  Fuel  System 

In  the  1960*8,  postcrash  fires  were  responsible  for  nearly  40  percent  of  all  Army 
rotary-wing  fatalities  in  potentially  survivable  accidents.  In  an  effort  to  find  a 
solution  to  this  tragic  problem,  the  US  Army  Applied  Technology  Laboratory  conducted  ex¬ 
tensive  efforts  aimed  at  developing  a  crashworthy  fuel  system  (CWFS)  for  Army  helicopters. 
Particular  attention  was  given  to  the  derivation  of  fuel  tank  (bladder)  material  that  was 
cut,  tear,  and  rupture  resistant  while  incorporating  ballistic  tolerance  characteristics. 

A  CWFS  was  developed  that  consisted  of  self-sealing  breakaway  valves/couplings;  frangible 
attachments;  self-sealing  fuel  lines;  vent  valves;  cut,  tear,  and  rupture  resistant 
bladders;  and  a  means  of  preventing  postcrash  fuel  spillage  at  all  postcrash  attitudes. 

Due  to  the  seriousness  of  the  problem,  the  Army  approved  fleet  retrofit  of  all  helicopters 
with  a  CWFS  as  a  safety  issue. 

With  the  advent  of  the  Army  crashworthy  fuel  system,  postcrash  fire  statistics  have 
been  altered  dramatically.  During  the  past  12  years  the  incidence  of  thermal  fatalities 
and  injuries  for  CWFS-equipped  helicopters  has  been  essentially  nonexistent.  For  example, 
during  the  period  April  1970  to  June  1976,  for  helicopters  not  equipped  with  a  CWFS  there 
were  65  thermal  fatalities  compared  to  just  1  for  helicopters  equipped  with  a  CWFS.  This 
is  based  on  nearly  the  same  number  of  accidents  for  each  case.  Since  1976  there  have  been 
no  fatalities  attributed  to  thermal  injuries  in  potentially  survivable  accidents  of  Army 
helicopters.  The  highly  successful  application  of  this  crashworthiness  design  feature 
not  only  has  resulted  in  the  prevention  of  numerous  fatalities  and  a  large  loss  of  mate¬ 
riel  but  has  had  a  very  positive  effect  on  aviator  morale.  In  the  development  of  a 
specification  for  a  new  aircraft  system,  some  MIL-STD-1290  design  criteria  are  scrutinized 
for  applicability.  However,  this  is  not  the  case  for  criteria  dedicated  to  crashworthy 
>  fuel  Systems. 

YAH-63  Full-Scale  Crash  Test 

Since  the  early  1960's,  the  Army  has  conducted  a  series  of  41  full-scale  crash  tests 
of  fixed-  and  rotary-wing  aircraft.  The  objective  of  these  tests  has  been  to  measure, 


under  controlled  conditions,  the  dynamic  structural  and  occupant  response  to  a  variety  of 
crash  parameters. 

During  July  1981  the  Applied  Technology  Laboratory,  in  conjunction  with  the  NASA- 
Langley  Research  Center  (LRC)  and  the  US  Navy,  conducted  a  full-scale  crash  test  (T-41)  of 
a  YAH-63  attack  helicopter.  This  prototype  twin-engine,  15,000-pound  gross  weight  class 
aircraft  was  acquired  by  ATL  as  residual  hardware  following  the  Advanced  Attack  Helicopter 
(AAH)  fly-off  competition.  The  crashworthy  design  of  the  YAH-63  is  considered  representa¬ 
tive  of  that  found  in  the  Army's  production  advanced  attack  helicopter,  the  AH-64  APACHE. 

It  is  significant  that  this  was  the  first  crash  test  of  an  Army  aircraft  designed  from  its 
inception  to  incorporate  most  of  the  MIL-STD-1290  crashworthiness  requirements,  and  it 
presented  a  unique  opportunity  to  assess  the  effectiveness  of  actual  crashworthiness  design 
applications.  Specific  crashworthy  features/experiments  on  T-41  were: 

.  Two-stage  air/oil  crashworthy  landing  gear 

.  Controlled  crush  belly  structure 

.  Production  AH-64  load-limiting  crewseat  incorporating  12-inch  maximum  stroke 

.  Developmental  joint  Army/Navy  Inflatable  Body  and  Head  Restraint  System  (IBAHRS) 
on  front  crewman 

.  Prototype  Integrated  Helmet  and  Display  Sight  System  (IHADSS)  on  front  crewman 

.  Crashworthy  fuel  system  including  tanks,  lines,  fittings 

.  Tie-down  strength  of  high-mass  items  sufficient  for  survivable  crash  loads 

.  Developmental  Navy  Flight  Incident  Recorder/Crash  Position  Locator  (FIR/CPL) 

.  Developmental  Army  Accident  Information  Retrieval  System  (AIRS) 

.  NASA  experimental  package  of  Emergency  Locator  Transmitters  (ELT's)  and  crash 
sensors 

The  crash  test  was  accomplished  using  the  cable  swing/drop  method  at  the  NASA-LRC 
Impact  Dynamics  Research  Facility.  Cables  were  rigged  to  simulate  a  50-ft/sec  resultant 
impact  vector  of  95th  percentile  severity.  The  planned  impact  conditions  were  30-ft/sec 
longitudinal  velocity,  40-ft/sec  vertical  velocity,  and  10  degree  nose-up  pitch  attitude. 
Figure  19  shows  the  aircraft  in  its  pretest  pull-back  position.  Due  to  overestimates  of 
aircraft  drag,  actual  impact  conditions  were  considerably  more  severe.  The  actual  impact 
vectors  were  36.2-ft/sec  longitudinal  velocity,  48.0-ft/sec  vertical  velocity  for  a 
60.1- ft/sec  resultant  vector.  As  a  result,  the  impact  contained  44  percent  more  energy 
than  the  planned  95th  percentile  value  which  places  it  in  the  nonsurvivable  range.  A 
still  sequence  photo  taken  approximately  150  milliseconds  after  tail  contact  is  shown  as 
Figure  20. 


Figure  19.  YAH-63  in  Pull-Back  Position  Figure  20.  YAH-63  Approximately  150 

Prior  to  Crash  Test.  Milliseconds  After  Impact. 

The  production  bulkhead-mounted  AH-64  crewseat  traveled  through  its  entire  12  inches 
of  available  stroke  and  "bottomed"  on  its  stops  due  to  the  excessive  vertical  energy.  The 
accelerometer  traces  which  recorded  the  seat  mounting  bulkhead  and  the  seat  pan  vertical 
accelerations  are  overlaid  in  Figure  21.  Note  particularly  the  seat  pan  bottoming  pulse 
which  remained  above  the  23  G  Eiband  criteria  for  17  milliseconds.  A  dynamic  response 
index  (DRI)  of  23  was  later  calculated.  Ejection  seat  relationships  established  by  the  US 
Air  Force  indicate  that  this  corresponds  to  a  greater  than  50  percent  probability  of 
spinal  injury  for  the  forward  located  copilot/gunner  occupant.  Detailed  data  relating  to 
this  test,  along  with  a  correlation  of  predictive  versus  actual  results  from  use  of  com¬ 
puter  program  KRASH,  are  available  in  Reference  10. 

In  summary,  the  crashworthy  landing  gear,  crushable  structure,  stroking  seats,  crash- 
worthy  fuel  system,  and  high  mass  component  retention  all  functioned  successfully?  and  had 
the  desired  impact  velocities  (95th  percentile  survivable  velocities)  been  obtained,  non¬ 
in  jurious  accelerative  loadings  would  have  been  realized  by  the  occupants. 


UH-60A  BLACK  HAWK  CRASHWORTHINESS  EXPERIENCE 


The  UH-60A  BLACK  HAWK  helicopter  is  the  first  operational  Army  helicopter  designed 
from  inception  for  crashworthiness  using  the  requirements  of  the  "Crash  Survival  Design 

Guide."  The  results  have  been 
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dramatic,  as  evidenced  by  the 
following  summary  of  a  recent 
Class  A  UH-60A  mishap: 


Figure  21. 


Copilot/Gunner  (CPG)  Bulkhead  and  Seat  Pan 
Vertical  Accelerations. 


The  aircraft  crashed  approx¬ 
imately  20°  nose  high  with  a 
horizontal  velocity  of  34  ft/sec 
and  a  vertical  velocity  of  49  ft/ 
sec,  giving  a  resultant  velocity 
of  60.4  ft/sec,  which  for  a  non¬ 
crashworthy  aircraft  is  consid¬ 
ered  a  nonsurvivable  impact.  The 
impact  sequence  is  shown  in 
Figure  22.)  The  aircraft  then 
rebounded  with  left  yaw  and  right 
roll  until  resting  on  its  right 
side  up  against  a  tree.  The  per¬ 
formance  of  the  energy-absorbing 
tail  and  main  landing  gear  and 
the  stroking  energy  attenuating 
crew  seats ,  coupled  with  the 
structural  design  for  high  mass 
component  retention,  resulted  in 


maintaining  a  protective  shell  around  the  pilot  and  copilot  and  keeping  the  acceleration 
loadings  in  the  cockpit  below  injurious  levels.  After  the  crash  sequence,  the  copilot 
walked  away  from  the  aircraft  with  minor  abrasions.  The  pilot  suffered  a  broken  leg  and 
elbow  as  a  result  of  flailing  contact  with  the  cyclic  stick  and  seat  wing  armor,  respec¬ 
tively.  The  crashworthy  fuel  system  performed  perfectly,  which  in  this  case  was  lifesaving 
in  that  the  right  side  facing  gunner  seat  occupied  by  the  crew  chief  failed,  resulting  in 
critical  injuries  to  this  individual.  A  design  modification  is  underway  to  improve  the 
stroking  gunner  seat. 


FINAL  MAJOR  INITIAL 
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Figure  22.  Crash  Impact  Sequence. 

The  UH-60A  crashworthiness  demonstrated  in  this  mishap  is  remarkable  and  substantiates 
that  design  for  crashworthiness  will  prevent  many  fatalities  and  injuries,  and  the  loss  of 
materiel  during  the  life  cycle  of  the  BLACK  HAWK  fleet. 

WEIGHT  IMPACT  AND  EFFECTS  ON  LIFE-CYCLE  COST 

The  many  benefits  realized  by  enhancing  aircraft  crashworthiness  are  not  obtained 
without  some  impact  on  the  weight  of  the  aircraft.  As  discussed  previously,  this  impact 
can  be  minimized  during  the  development  of  completely  new  aircraft  designs  as  compared  to 
retrofitting  crashworthiness  features  on  existing  aircraft.  A  brief  survey  of  seven  con¬ 
temporary  helicopter  designs  (a  mix  of  civil  and  military  designs)  revealed  varying  degrees 
of  integral  crashworthiness,  ranging  from  partial  to  nearly  complete  compliance  with 
MIL-STD-1290.  Weight  increments  attributed  solely  to  crashworthy  features  fell  between 
1.59  and  3.68  percent  of  design  gross  weight.  Within  this  range,  the  weight  addition  due 
to  use  of  a  crashworthy  fuel  system  averaged  1.07  percent  of  the  design  gross  weight.  Thus 
all  protective  features  excluding  the  CWFS  averaged  1.64  percent  of  design  gross  weight, 
which  is  considered  to  be  an  extremely  small  weight  increment  for  such  a  high  potential 
return  in  mission  effectiveness.  Of  course,  the  weight  increase  due  to  crashworthiness 
design  is  reflected  in  aircraft  system  acquisition  and  operating  costs. 
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From  a  total  aircraft  systems  design/operational  perspective,  design  for  crashworthiness 
can  have  a  significant  impact  on  life-cycle  cost,  especially  considering  the  fact  that  Army 
helicopters  sometimes  remain  in  the  operational  fleet  for  30  years  or  more.  In-house 
analyses  have  been  conducted  to  assess  the  effects  of  crashworthiness  on  life-cycle  cost, 
considering  such  variables  as  aircraft  acquisition  cost;  cost  of  incorporating  aircraft 
crashworthiness  features;  increased  operational  cost  due  to  weight/performance  penalties 
for  the  crashworthy  features;  personnel  training  cost;  cost  of  crew  injuries/fatalities  in 
accidents;  and  accident-related  property  damage  cost.  Depending  on  the  total  cumulative 
flying  hours  per  year  for  a  fleet  of  helicopters,  the  break-even  point,  i.e.,  the  point 
where  the  additional  costs  for  incorporating  crashworthy  design  features  is  offset,  can 
occur  in  as  little  as  3  (wartime  flying  hour  rate)  to  approximately  9  years  (current  peace¬ 
time  flying  rate) .  Beyond  the  break-even  point  the  cost  of  owning  and  operating  the  fleet 
is  reduced  as  a  result  of  the  crashworthy  design.  Again,  these  analyses  consider  only  the 
costs  associated  with  aircraft  damage,  personnel  injuries/fatalities,  and  property  damage. 

The  total  "costs"  that  are  associated  with  increased  mission  effectiveness  as  provided  by 
incorporating  crashworthy  design,  although  very  difficult  to  define  and  quantify,  have  the 
potential  of  being  highly  significant  in  a  positive  sense. 

RELATIONSHIP  TO  CIVIL  AVIATION 

In  the  civil  aviation  community,  prevention  of  accidents  has  always  been  a  high  pri¬ 
ority.  However,  even  with  technological  advancements,  increased  mechanical  reliability, 
improved  pilot  training,  and  intensive  studies  of  accident  causal  factors,  accidents  do 
occur.  Statistics  from  Reference  11  indicate  that  for  one  decade  (1967-1976)  the  number  of 
general  aviation  aircraft  involved  in  accidents  was  equivalent  to  at  least  38  percent  of  the 
total  US  production  during  that  period.  Estimates  that  an  aircraft  will  be  involved  in  an 
accident  over  a  20-year  life  range  are  as  high  as  60-70  percent. 

Recognizing  this  accident  probability,  it  makes  sense  to  apply  a  worthwhile  degree  of 
crashworthiness  to  contemporary  design  philosophy.  Because  of  differences  in  mission  pro¬ 
files,  civil  aircraft  are  normally  flown  somewhat  differently  than  Army  helicopters.  The 
FAA  Technical  Center  currently  has  an  effort  underway  to  better  define  the  civil  helicopter 
crash  environment  ("Rotorcraft  Crashworthiness  Scenarios,"  FAA  Contract  DTFA03-81-C-00035 
with  Simula,  Inc.,  Tempe,  Arizona,  scheduled  for  completion  in  August  1983).  The  civil 
helicopter  crash  environments  may  not  be  sufficiently  severe  to  justify  using  all  of  the 
MIL-STD-1290  crashworthiness  design  techniques  that  have  been  addressed  in  this  paper. 

From  a  cost  viewpoint  the  easiest  to  justify  might  be  the  use  of  state-of-the-art  restraint 
and  energy  absorbing  seat  systems,  although  the  crashworthy  fuel  system  should  perhaps  be 
at  the  top  of  the  priority  listing  of  needed  crashworthy  features.  As  composite  airframe 
structures  become  more  attractive  from  a  cost/weight  standpoint,  their  demonstrated  potential 
(Reference  12)  to  act  as  good  energy  abporbers  should  not  be  overlooked.  Usually,  however, 
design  innovations  to  benefit  crashworthiness  will  equate  to  a  design  in  excess  of  the 
Federal  Air  Regulations  (FAR's),  which  are  intended  as  minimum  requirements  only  rather  than 
design  goals.  FAA  Order  DA  2100.1  clearly  states,  "Such  standards  do  not  constitute  the 
optimum  to  which  the  regulated  should  strive"  (Reference  13) . 

Finally,  not  to  be  overlooked  in  the  civil  area  is  the  very  real  economic  savings  that 
can  be  gained  (in  concert  with  crashworthiness)  from  the  inclusion  of  an  energy  absorbing 
(EA)  landing  gear.  The  potential  Army  savings  were  addressed  earlier  and  would  certainly, 
to  a  degree,  apply  in  the  civil  market.  Avoided  materiel  damage  from  hard  landings  alone 
should  go  a  long  way  toward  justifying  an  EA  gear. 

Some  design  practices,  such  as  excellent  protective  structure  around  the  occupant  along 
with  adequate  restraint  in  agricultural  aerial  application  airplanes,  are  now  standard  pro¬ 
cedure.  In  time,  it  is  hoped  that  a  variety  of  meaningful  crashworthiness  improvements  will 
be  providing  increasingly  higher  levels  of  occupant  protection  and  damage  avoidance. 

MAJOR  PROGRAM  NEEDS 

Considering  the  significant  potential  payoff  for  designing  Army  helicopters  for  improved 
crash  survivability,  the  difficulty  in  retrofitting  existing  aircraft  to  make  them  more  crash 
survivable,  and  the  potential  for  crashworthiness  criteria  to  significantly  drive  a  new  air¬ 
craft  system  design,  the  need  exists  to: 

.  Expand  the  Army  aviation  crash  survivability  program  to  develop  more  efficient 
concepts  and  measures  for  improving  helicopter  crashworthiness  while  having  min¬ 
imum  impact  on  aircraft  system  weight,  performance  and  cost. 

.  Continually  improve/upgrade  crashworthiness  design  criteria  and  standards,  con¬ 
sidering  lessons  learned  from  the  UTTAS  and  AAH  development  programs;  lessons 
learned  from  BLACK  HAWK  and  APACHE  helicopter  operational  experience;  results  from 
the  various  composite  airframe  programs;  and  new  VTOL  design  concepts  (e.g.,  tilt 
prop/rotor,  which  is  a  cross  between  the  pure  helicopter  and  fixed-wing  aircraft). 

CONCLUSION 

.  Too  many  US  Army  aircrewmen  are  still  being  fatally  injured  in  potentially  sur- 
vivable  accidents,  and  the  percentage  of  major  injuries  and  rate  of  materiel 
losses  are  still  far  too  high. 

.  Technology  and  design  criteria  presently  exist  to  significantly  reduce  these  per¬ 
sonnel  injuries/fatalities  and  materiel  losses  associated  with  helicopter  accidents. 
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.  Army  aviation  mission  effectiveness  can  be  significantly  enhanced  through  the 
application  of  crashworthiness  design  to  Army  helicopters. 

.  Life-cycle  costs  can  be  significantly  reduced  through  the  application  of  crash- 
worthiness  design  to  Army  helicopters. 

.  MIL-STD-1290  has  proved  to  be  a  viable,  cost-effective  requirements  document. 

.  Although  much  higher  levels  of  crashworthiness  can  be  achieved  in  a  complete  new 
helicopter  system  design,  significant  improvements  can  be  made  in  the  crashworthi¬ 
ness  of  existing  helicopters  through  retrofit  programs. 

.  The  need  exists  to  continue  to  develop  and  apply  efficient  and  economical  measures 
for  improving  the  crash  survivability  of  existing  and  new-generation  helicopters. 

.  The  need  exists  to  continually  improve/update  helicopter  crashworthiness  design 
criteria  and  standards. 

.  Military  helicopter  crashworthy  features  are  directly  applicable  to  the  civil/ 
commercial  helicopter  fleet. 
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SUMMARY 

This  paper  overviews  the  development  of  the  digital  fly-by-wire  Flight  Control  System  (FCS)  in  the  F/A-18 
aircraft.  A  general  description  of  the  FCS  and  as  overview  of  the  significant  changes  that  have  been  incorporated  to 
improve  handling  qualities  and  to  correct  anomalies  that  were  discovered  during  the  Full  Scale  Development  (FSD) 
program  are  presented.  The  interface  of  the  FCS  with  the  total  avionics  package  of  the  F/A-18  via  the  1553  multiplex 
bus  and  the  impact  of  this  interface  on  specific  flight  testing  and  FCS  development  is  also  highlighted.  The  impact  of 
the  flight  control  laws  on  high  Angle  of  Attack  (AOA)  handling  qualities,  including  a  discussion  of  the  changes  that  were 
made  as  a  result  of  a  spin  accident  in  November  1980,  is  presented.  Throughout  the  discussion,  references  to  the 
specialized  displays  and  controls  that  are  implemented  in  the  F/A-18  to  assist  the  pilot  and  enhance  flight  testing  and 
safety  are  discussed^ 


'\ 


LIST  OF  SYMBOLS 


<x 

- 

Angle  of  Attack 

Nz 

- 

Normal  Acceleration 

ADC 

- 

Air  Data  Computer 

OAT 

“ 

Outside  Air  Temperature 

Ay 

- 

Lateral  Acceleration 

P 

Roll  Rate 

cNin 

- 

Directional  Divergence  Parameter 

Ps 

- 

Static  Pressure 

PDyn 

(=C«„COS«-I,C.  SINa) 

q 

Pitch  Rate 

e  ^ 

9c 

- 

Dynamic  Pressure 

cig 

- 

Lateral  Stability  Derivative 

9ci 

" 

Dynamic  Pressure,  Indicated 

cn« 

v 

Yawing  Moment  Coefficient 

R 

- 

Yaw  Rate 

C  • 

'-'m 

- 

Pitching  Moment  Coefficient 

S 

Wing  Area 

dB 

- 

Gain  in  Decibels  of  Bandpass  Filter 

TA 

- 

Ambient  Temperature 

AQc; 

- 

Differential  Dynamic  Pressure 

tas 

True  Airspeed 

«H 

- 

Stabilator  Deflection 

T,X 

- 

Time  Constant,  sec 

®R 

- 

Rudder  Deflection 

*1 

- 

Time  Constant  in  Pade  Approximation  in 

Fs/g 

- 

Longitudinal  Stick  Force/g 

Bandpass  Filter 

G 

- 

Ny  Units 

t2>  t3 

Real  Roots  in  Numerator  of  Bandpass  Filter 

lx 

- 

Roll  Inertia 

»1>  “>2.  *3 

- 

Frequency  of  Numerator  and  Denominator 

Iy 

- 

Pitch  Inertia 

Terms  in  Bandpass  Filter 

Iz 

- 

Yaw  Inertia 

Sl>  ?2>  5  3 

Damping  of  Numerator  and  Denominator 

K 

- 

Gain  of  Bandpass  Filter 

Terms  in  Bandpass  Filter 

L/D 

- 

Lift/Drag  Ratio 

Ny 

- 

Lateral  Acceleration 

FUGHT  CONTROL  SYSTEM  DfcSCRIPllON 


The  FCS  in  the  F/A-18  employs  a  full  authority,  high 
gain  control  augmentation  mechanization.  Early  versions 
of  the  FCS  (3  series  and  4  series  Programmable  Read  Only 
Memory  (PROMS))  utilized  applied  stick  forces  to 
generate  the  electrical  inputs  required  to  control  the 
aircraft.  A  major  FCS  design  philosophy  change  was 
implemented  in  6.X  series  and  subsequent  PROMS  so  that 
stick  position  vice  stick  force  is  utilized  to  generate  the 
electrical  inputs  which  are  then  routed  to  the  flight 
control  computers  (FCC)  to  be  processed  through 
specified  control  laws  to  provide  desired  aircraft  response 
(figure  1). 

Primary  pitch  control  is  provided  by  symmetric 
deflection  of  horizontal  stabilators.  Trailing  edge  and  full 
span  leading  edge  maneuvering  flaps  provide  optimum 
lift-to-drag  ratios  for  maneuvering,  cruise  and  high  AOA 
flight  conditions.  In  approach  configurations,  leading  edge 
flaps  and  rudders  (toed-in)  are  scheduled  with  AOA  to 
improve  longitudinal  stability  characteristics.  Trailing 
edge  flaps  are  scheduled  with  dynamic  pressure  (qc)  to  a 
maximum  deflection  of  30  or  45  degrees  (TED)  dependent 
on  flap  switch  position.  The  ailerons  are  symmetrically 
drooped  to  match  the  scheduled  trailing  edge  flap 
deflection.  A  speed  brake  located  on  the  upper  surface  of 
the  aft  fuselage  provides  drag  control  in  the  cruise 
configurations  (Flaps-UP/AUTO).  Roll  control  is  provided 
by  conventional  ailerons,  differential  stabilators,  and 
differential  deflection  of  the  leading  and  trailing  edge 
flaps  (differential  flap  deflections  are  dependent  on  flight 
conditions).  Directional  control  is  provided  by  dual 
rudders.  A  rolling  surface  to  rudder  interconnect  (RSRI)  is 
used  to  improve  turn  coordination.  Also,  a  rudder  pedal  to 
roll  command  signal  is  used  to  improve  roll  response  at 
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Figure  1  F/A-18  FCS  Functional  Diagram 
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higher  AOA  in  cruise  configuration  and  to  reduce  sideslip  excursions  in  approach  configurations.  The  control  laws 
automatically  revert  to  a  SPIN  mode  if  specific  yaw  rate  conditions  are  exceeded  to  facilitate  recovery  from  out  of 
control  flight.  Additionally,  pilot  relief  modes  are  provided  through  the  autopilot  to  facilitate  weapon  system 
management. 

Power  to  the  FCS  is  supplied  by  28  Vdc  Power  from  the  aircraft's  electrical  system.  Four  independent  branches  of 
the  hydraulic  system  provide  primary  and  backup  hydraulic  pressure  to  the  surface  actuators.  For  three  similar  failures 
of  motion  feedback  sensors  in  a  given  axis,  control  is  accomplished  using  a  digital  Direct  Electric  Link  (DEL)  mode, 
which  provides  a  direct  electrical  path  from  the  pilot  input  sensor  to  the  control  surface  actuator.  Should  three  digital 
processors  fail,  longitudinal  and  roll  control  is  accomplished  by  a  backup  mechanical  mode  to  the  stabilators.  The 
mechanical  controls  are  conventional  cable,  push  rod,  and  bellcrank  systems.  In  the  mechanical  backup  mode, 
stick- to-stabilator  gearing  is  modified  by  a  nonlinear  linkage  to  provide  the  desired  sensitivity  between  stick  forces  and 
deflections  for  all  flight  conditions.  Aileron  or  rudder  control  is  available  in  the  mechanical  mode  through  an  analog 
DEL  path.  In  the  event  of  a  total  electrical  failure,  only  mechanical  control  of  the  stabilators  is  available. 

Reliability  and  maintainability  of  the  FCS  have  been  enhanced  during  the  FSD  program  by  continued  improvements 
to  the  designed  Built-in-Test  (BIT),  the  memory  inspect  (MI),  and  the  maintenance  monitor  capability.  Additionally, 
expanded  maintenance  advisory  information  is  available  through  the  incorporation  of  BIT  Logic  Inspect  (BUN) 
capability.  This  feature  provides  the  capability  to  automatically  search  the  flight  control  computer  memory  to  obtain 
relevant  failure  isolation  data  and  display  it  by  channel  on  the  cockpit  displays.  A  more  complete  description  of  the  BIT, 
MI,  and  BUN  features  is  contained  in  reference  1. 

FUGHT  CONTROL  SYSTEM  INTERFACE 


The  FCS  interfaces  with  other  avionics  in  the 
F/A-18  via  a  1553  multiplex  bus  as  shown  in 
figure  2.  It  is  this  interface  capability  which,  in 
conjunction  with  the  unique  FCS  displays  and 
controls,  aided  the  development  and  testing  of  the 
FCS.  The  mission  computer  (MC)  FCC  interface 
was  designed  to  allow  the  FCC's  to  receive  data 
for  outer  loop  control  computations  and  initiated 
BIT  commands  and  to  transmit  sensor  data,  flight 
test  data,  and  BIT  results  to  the  other  avionic 
components  in  the  aircraft.  The  BUN  and  Ml 
inspect  features  mentioned  earlier  are  also 
dependent  on  the  interface  capability  provided  by 
the  1553  multiplex  bus.  During  the  course  of  FCS 
development,  the  MC-FCC  interface  provided  a 
unique  capability  for  specialized  diagnostic 
testing  in  the  areas  of  performance,  high  AOA, 
and  development  of  the  active  oscillation 
controller. 


Figure  2  Flight  Control  Interface 


SPECIAUZED  CONTROLS  AND  DISPLAYS 


Several  specialized  displays  and  controls  were  incorporated  to  enhance  safety  and  facilitate  FCS  testing.  FCS 
controls  and  displays  are  shown  in  figure  3.  Special  displays  that  aided  in  FCS  testing  included  the  FCS  failure  matrix 
display  shown  in  figure  4  and  the  specialized  SPIN  displays  discussed  later  in  this  paper.  The  FCS  failure  matrix  display 
provided  the  pilot  with  status  information  on  which  FCS  shutoff  valve  or  sensor  had  failed  whenever  a  FCS  caution 
occurred.  Additionally,  a  reset  feature  was  provided  via  a  button  on  the  flight  control  panel  (figure  3).  Positive 
indication  of  a  successful  reset  for  a  given  failure  was  provided  by  removing  the  X  from  the  FCS  failure  matrix.  This 
same  information  was  provided  via  a  similar  binary  display  panel  in  the  ground  station  which  displayed  FCS  status  to 
ground  test  personnel. 


Figure  3  FCS  Controls  and  Displays 
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FLIGHT  CONTROL  SYSTEM  DEVELOPMENT 


GENERAL 

Throughout  the  FSD  flight  test  program  of 
the  F/A-18  airplane,  several  updates  and  changes 
to  the  basic  control  laws  that  provide  the  signal 
shaping  between  pilot  command  inputs  and 
resultant  control  surface  commands  have  been 
made.  The  versatility  of  the  digital  design  of  the 
F/A-18  FCS  provides  a  unique  and  practical  way 
of  implementing  any  desired  control  law  changes. 
Control  laws  are  programmed  on  a  number  of 
PROM  modules  which  are  mounted  on  removable 
boards  in  each  of  the  two  FCC's.  Control  law 
changes  are  introduced  by  incorporating  updated 
or  revised  PROM’s.  Since  the  first  flight  in  the 
F/A-18  {18  November  1978),  five  major  PROM 
series  (more  than  56  PROM  versions)  have  been 
evaluated.  The  major  PROM  versions  tested 
include  3.X  series,  4.X  series,  6.X  series, 
7.X  series,  and  8.X  series  PROMS.  Table  1 
summarizes  the  major  changes  that  were 
incorporated  in  each  of  the  major  PROM  series. 
Control  law  changes  have  been  incorporated  to 
improve  handling  qualities  at  all  flight  conditions 
(including  high  AOA  and  out-of-control),  improve 
roll  performance,  reduce  structural  loads, 
improve  departure  resistance  characteristics,, 
incorporate  and  refine  pilot  relief  modes,  and 
provide  an  active  oscillation  controller  to 
suppress  undesirable  in-flight  oscillations. 

FCS  HIGH  AOA  CONTROL  LAW  DEVELOPMENT 


Table  I 


PROM  SERIES  VERISON 


PROM  Version 

Reasons  for  Change 

Time 

Frame 

3.X  (7  Total) 

(3.11,  3.12,  3.16,  3.18, 
3.19,  3.21,  3.23) 

Improve  Handling  Qualities 
Improve  Carrier  Suitability 

Nov  1978- 
Dec  1979 

4.X  (26  Total) 

(4.0,  4.1,  4.3.0.X, 
4.3.1.X,  4.3.2) 

Reduce  Time  Delays 

Add  RSRI  vice  SRI 

Spin  Mode  Improvements 

Roll  Modifications 

Jan  1980- 
Nov  1981 

6.X  (4  Total) 

(6.0,  6.0. 1.1,  6.0.1, 
6.0.2) 

Reduce  Time  Delays 

Position  vice  Force  Sensors 
Autopilot  Modes  Incorporated 

Nov  1981 

7.X  (14  Total) 

(7.0.  7.1.X,  7.2,  7.3, 

7.4) 

Revised  Spin  Logic 

Improve  Directional  Stability 
AOC  Development 

Mar  1982 

8.X  (4  Total) 

8.0,  8.1,  8.2,  8.2.1 

Throttle  Sensitivity 

Autopilot/APC/ACLS 

Improvements 

July  1982 

Two  of  the  major  design  goals  for  the  FCS  at  high  AOA  were  (1)  to  augment  departure /spin  resistance  and  (2)  to 
automatically  provide  sufficient  control  authority  for  -ecovery  from  all  spin  modes.  It  was  also  important  that  FCS  air 
data  sensor  failures  (AOA,  Qci,  Ps)  not  degrade  high  AOA  departure/spin  resistance  or  inhibit/prevent  recovery  from 
poststall  gyrations  or  spins.  During  FSD  high  AOA/spin  testing,  many  changes  were  made  to  improve  high  AOA 
characteristics  and  spin  recovery  capability.  On  occasion,  unexpected  FCS  response  occurred  in  the  high  AOA  flight 
region.  As  a  result  of  these  experiences,  the  FCS  has  become,  at  the  same  time,  more  complex  and  more  effective  in 
this  flight  regime.  In  addition,  unique  spin  recovery  cockpit  display  concepts  have  been  successfully  verified  that  have 
the  potential  to  significantly  increase  flight  safety.  The  purpose  of  this  section  is  to  briefly  describe  some  of  the  design 
concepts  applied  in  the  FCS  at  high  AOA  and  to  relate  some  of  the  more  significant  changes  made  to  the  control  laws 
based  on  test  results  obtained  during  FSD  flight  tests. 

Longitudinal  Axis;  A  simplified  version  of  current  high 
AOA  longitudinal  control  law  mechanization  is  illustrated 
in  figure  5.  Several  feedbacks  are  utilized  in  the  FCS  to 
provide  desired  high  AOA  handling  qualities 
characteristics.  Normal  acceleration  feedback  provides 
essentially  constant  stick  force  per  G  at  airspeeds  above 
approximately  390  KCAS.  Pitch  rate  feedback  is  blended 
with  N2  feedback  between  390  KCAS  and  260  KCAS  to 
improve  low  airspeed  high  AOA  controllability.  Roll  rate 
X  yaw  rate  feedback  is  utilized  to  reduce  inertia  coupling  tendencies  which  were  encountered  particularly  in  the  15  to 
20  degree  AOA  region  and  to  reduce  vertical  tail  loads  at  high  airspeed.  AOA  feedback  provides  an  artificial  high  AOA 
stall  warning  cue  by  abruptly  increasing  the  stick  force  per  degree  g  gradient  above  22  degrees  AOA  as  illustrated  in 
figure  6.  A  stall  warning  tone  is  generated  as  AOA  increases  above  35  degrees.  AOA  feedback  thresholds  in  order  of 
occurrence  have  ranged  from  23  to  20  to  15  and  back  to  22  degrees  during  FSD  testing.  The  design  goal  was  to  provide 
necessary  artificial  stall  warning  and  at  the  same  time  satisfy  maneuvering  AOA  (15  to  30  degrees)  handling  qualities 
requirements,  particularly  in  the  air  combat  maneuvering  environment  (ACM).  As  an  example,  the  AOA  feedback 
threshold  was  changed  from  15  to  22  degrees  due  to  undesirable  Fs/g  changes  with  airspeed.  With  the  threshold  set  at 
15  degrees  AOA,  it  was  found  that,  during  simulated  ACM  evaluations,  there  was  an  undesirable  change  in  the  stick 
force  per  g  gradient  over  a  relatively  small  speed  range  as  illustrated  in  figure  7.  This  situation  was  rectified  by  shifting 
the  AOA  threshold  to  22  degrees. 


Figure  6  High  AOA  Feedback  Effect  on  Fs/g 


Figure  7  Fs/g  Versus  Airspeed  at  15  Degrees  AOA 
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Maneuvering  Flaps:  F/A-18  maneuverable  LEF  and  TEF 
provide  increased  lift,  increased  lateral-directional 
stability,  and  improved  dutch  roll  damping  at  high  AOA. 
In  the  UP/AUTO  configuration,  LEF  and  TEF  positions 
are  scheduled  with  AOA  and  Mach  number  as  illustrated 
in  figure  8.  Initial  FSD  high  AOA  flight  tests  focused  on 
lateral-directional  stability  and  control  characteristics 
at  AOA's  between  15  and  45  degrees.  During  this 
testing,  maximum  LEF  deflection  was  25  degrees  at 
AOA's  above  approximately  25  degrees.  Results  of 
testing  at  approximately  35  degrees  AOA  showed  a 
marked  reduction  in  Cfsja  (Directional  Divergence 
“Dyn 

Parameter),  as  shown  in  figure  9,  due  to  a  significant 
decrease  in  lateral  stability.  The  level  of  Cm.  at 

**Dyn 

AOA's  less  than  was  considered  unacceptable. 

As  a  result,  LEF  maximum  deflection  at  high  AOA  was 
subsequently  increased  to  34  degrees.  As  shown  in 
figure  9,  the  increased  LEF  deflection  provided 
increased  departure  resistance.  This  was  obtained  as  a 
result  of  increased  lateral  stability  up  to  approximately 
40  degrees  AOA.  The  trailing  edge  flap  scheduling 
strongly  affects  dutch  roll  damping  and  L/D  ratio. 
Current  F/A-18  control  laws  command  the  trailing  edge 
flaps  to  the  full  retracted  position  at  maneuvering 
AOA's  approximately  20  degrees. 
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Figure  10  Rolling  Surface  Authority  Versus  AOA 


AOA  oca 

Figure  8  Maneuvering  Flap  Schedules 
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Figure  9  Cna  Variation  with  LEF  Position 
PDyn 

Lateral-Directional  Axes:  Departure  and  spin  resistance 
is  further  increased  by  reducing  differential  tail  and 
aileron  authority  at  high  AOA's  (figure  10).  The  design 
intent  was  to  significantly  reduce  the  magnitude  of 
adverse  yaw  with  lateral  command  while  still  retaining 
as  much  coordinated  roll  response  as  possible.  The 
F/A-18  FCS  incorporates  a  rolling  surface  to  rudder 
interconnect  (RSRI),  functionally  similar  to  an  aileron- 
rudder  interconnect  (ARI),  which  provides  a  proverse 
yaw  contribution  during  lateral  stick  inputs,  further 
reducing  the  adverse  yaw  tendencies  and  improving  roll 
coordination  (figure  11).  A  rudder  pedal  to  rolling 
surface  interconnect  (figure  12)  is  also  included  in  the 
FCS  to  reduce  proverse  yaw  during  rudder  rolls.  The 
improved  roll  coordination  minimizes  N2  coupling  at 
high  AOA  due  to  kinematic  coupling  (i.e.,  interchange 
of  AOA  and  sideslip  during  uncoordinated  rolling 
maneuvers).  Several  feedbacks  are  utilized  at  high  AOA 
to  augment  bare  airframe  lateral-directional  stability 
(see  figures  11  and  12):  (a)  lateral  acceleration 
feedback  for  increased  directional  stability,  (b)  yaw 
rate  feedback  for  increased  directional  damping,  (c)  po 
(roll  rate  x  AOA)  feedback  for  improved  roll 
coordination  by  rolling  the  airplane  about  the  stability 
axis  (or  velocity  vector)  vice  the  body  axis,  (d)  roll  rate 
feedback  for  increased  Dutch  roll  damping,  and  (e)  PQ 
(roll  rate  x  pitch  rate)  and  PR  (roll  rate  x  yaw  rate) 
feedback  to  reduce  inertia  coupling  tendencies. 


Figure  11  Control  Laws  -  Directional  Axis 


“Figure  1 2  Control  Laws  -  Lateral  Axis 
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FCS  Control  Law  Inertia  Coupling  Compensation:  During  FSD  high  AOA  departure  resistance  testing,  negative  g 
departures  occurred  in  the  middle  of  the  maneuvering  envelope  {15  to  20  deg  AOA  region)  when  aggravated  controls 
were  applied  for  even  brief  periods  of  time  {less  than  2  seconds).  Data  analysis  indicated  that  these  departures  were 
primarily  caused  by  roll  coupling.  The  combined  effect  of  roll  coupling  in  combination  with  adverse  sideslip  led  to 
excessive  vertical  tail  loads  and  occasionally,  to  negative  g  excursions  approaching  the  negative  g  structural  limit.  The 
versatility  of  the  FCS  was  again  demonstrated,  in  this  case,  by  use  of  inertia  coupling  feedback  compensation. 

An  examination  of  the  equations  of  motion  shows  that  sideslip  and  g  overshoots  during  rolling  pullouts  can  be 
reduced  if  inertial  coupling  moments  can  be  alleviated.  Roll-yaw  coupling  generates  pitch  accelerations  by  roll  rate 
times  yaw  rate  multiplied  by  an  inertia  characteristic  ratio: 

q  =  pr  (Iz  -  Ix)/Iy 

Similarly,  roll-pitch  coupling  causes  yaw  acceleration  by  roll  rate  times  pitch  rate  multiplied  by  another  inertia 
characteristic  ratio: 

r  =  pq  (lx  -  Iy)/Iz 

Therefore,  appropriate  rudder  and  elevator  deflections  were  programmed  into  the  flight  control  PROMS  as  a  function  of 
dynamic  pressure  and  body  axis  rates  to  counter  yawing  and  pitching  moments  due  to  initial  coupling: 

fir  =  pq  (Iy  -  lx)/qsb  Cn 

Or 

*H  =  pr  (lx  -  Iz)/qsc 

Figure  13  illustrates  the  effect  of  inertia  coupling 
compensation  during  a  full  lateral  stick  input.  The 
magnitude  of  AOA  unloading  is  reduced  considerably  when 
the  inertial-coupling  compensation  is  engaged.  Full  lateral 
stick  rolls  were  also  markedly  improved  and  vertical  tail 
bending  moments  were  reduced  to  below  design  values. 

This  proved  to  be  one  of  several  instances  where  a  FCS 
software  programming  change  solved  difficult  flying 
qualities/structural  problems  that  would  usually  have 
required  a  hardware  change. 

FCS  Control  Law  Changes  for  Improved  Departure  Resistance:  During  the  later  stages  of  F/A-18  FSD  testing,  weak 
directional  departure  resistance  at  typical  maneuvering  AOA  was  identified.  Directional  departures  occurred  at  high 
subsonic  Mach  number  in  the  20  to  30  degrees  AOA  region  of  the  flight  envelope,  particularly  with  centerline  tank  or 
three  external  fuel  tank  loadings.  F/A-18  basic  airframe  plus  centerline  tank  weak  directional  stability  levels  at  high 
subsonic  Mach  number  are  illustrated  in  figure  14.  Departures  at  high  dynamic  pressure  flight  conditions  were  of  serious 
concern  primarily  because  of  the  potential  for  structural  overload  of  the  vertical  tails.  The  result  of  FCS  software 
changes  to  correct  a  significant  flying  qualities  deficiency  was  again  clearly  demonstrated.  The  result  of  FCS  control 
law  changes  on  departure  resistance  is  illustrated  in  figure  15.  As  can  be  seen,  the  final  control  law  version  (7.1.3 
PROMS)  was  successful  in  controlling  sideslip  at  high  subsonic  Mach  number  which  eliminated  nose  slice  departures  with 
symmetric  stores  loadings. 


Figure  13  Effect  of  Inertia  Coupling  Compensation 
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Figure  14  Centerline  Tank  Loading  Mach  Number/ 
AOA  Effect  on  Directional  Departure  Resistance 


Figure  15  Control  Law  Effects  on  Departure  Resistance 


15-6 


Evolution  of  FCS  control  law  changes  made  to  eliminate  departures  is  illustrated  in  figure  16.  The  most  significant 
control  law  changes  made  were  reduced  rolling  surface  authority  with  increasing  AOA  and  Mach  number  and 
significantly  increased  lateral  acceleratioin  feedback  to  rudder  gain.  The  design  tradeoff  made  was  reduced  roll  rate 
capability  at  high  AOA/high  Mach  for  increased  departure  resistance. 


Figure  16  FCS  Changes  for  Improved 
Departure  Resistance  at  High  AOA 

FLIGHT  CONTROL  SYSTEM  TESTING 


GENERAL 

Flight  testing  of  the  F/A-18  has  involved  both  the 
classical  stability  and  control  tests  (reference  2)  listed 
in  table  n  and  specialized  frequency  sweep  techniques 
(used  for  equivalent  system  analysis).  Additionally,  a 
major  emphasis  was  placed  on  the  definition  and 
performance  of  precise  mission  tasks.  A  list  of  the 
mission  tasks  evaluated  during  the  development  testing 
of  the  F/A-18  is  presented  in  table  n.  The  primary 
evaluation  criteria  used  when  evaluating  the  assigned 
tasks  was  the  Cooper-Harper  Scale  reference  3. 
Handling  qualities  ratings  assigned  to  these  precisely 
defined  tasks  have  provided  the  most  effective 
quantifying  measurement  of  the  FCS  performance 
during  its  evaluation.  In  addition  to  the  handling 
qualities  ratings  assigned  to  mission  tasks,  the  FCS  has 
also  been  quantified  in  terms  of  equivalent  system 
frequencies  and  damping  using  a  maximum  likelihood 
parameter  identification  technique  reference  4.  The  use 
of  this  parameter  identification  technique  has  been 
very  successful  in  demonstrating  the  success  the 
contractor  has  had  in  reducing  the  overall  system 
equivalent  time  delay  as  the  control  laws/FCS  changes 
evolved. 


Table  n 


Classical  Flight  Test  Maneuvers 


Maneuver 

Doublet 

Pitch  and  Bank  Attitude  Captures 

Frequency  Sweeps 

Wind-Up  Turn 

Wind  Down  Turn 

Sudden  Pull  Ups 

Full  Deflection  Rolls 

Primary  Mission  Tasks 

Mission  Task 

Performance  Criteria 

Column  Formation 

300  KCAS/2  g 

400  KCAS/4  g 

Maintain  position  (20  feet  nose- 
to-tail,  20  feet  stepdown) 

+  10  feet  at  400  KCAS/4g; 
+5  feet  at  300  KCAS/2  g. 

Aerial  Refueling 

250  KCAS 

Engage  and  maintain  a  plugged 
position. 

Air-to-Air  Tracking 

300  KCAS/2  g 

350  KCAS/3  g 

400  KCAS/4  g 

Track  a  stabilized  target  at 
specified  flight  condition. 

Maintain  pippeT  +2  mils  on 
targets  tailpipe  while  main¬ 
taining  1500  feet  nose-to-tail 
distance. 

Air-to-Ground  Tracking 
30°  Dive 

45°  Dive 

60°  Dive 

Maintain  pipper  +2  mils  on 
target. 

Special  Flight  Control  Panel:  A  special  flight  test  flight  control  panel  was  provided  in  selected  FSD  aircraft  to  permit 
flight  testing  of  the  degraded  modes  of  the  FCS.  The  design  features  of  this  special  flight  control  panel  allowed  the 
pilot  to  select  the  DEL  or  mechanical  mode  of  the  FCS  in  each  control  axis  (pitch,  roll,  or  yaw).  Figures  17(a)  and  (b) 
show  the  special  flight  test  flight  control  panel  and  defines  the  mode  selected  with  each  switch  position.  Selection  of 
the  different  available  modes  required  the  pilot  to  select  the  desired  mode,  place  the  arm  switch  to  arm,  then  depress 
the  nosewheel  steering/designate  switch  on  the  control  stick.  Disengagement  from  the  selected  mode  and  reversion  to 
the  normal  CAS  mode  was  rapidly  available  by  depressing  the  autopilot  disengagement  switch  on  the  control  stick. 

This  same  special  flight  test  control  panel  was  also  utilized  during  diagnostic  testing  of  the  various  roll 
modifications.  Use  of  the  special  panel  to  deselect  portions  of  the  roll  modifications  is  also  shown  in  figure  17(c).  The 
significant  difference  between  using  the  panel  for  degraded  modes  and  as  a  diagnostic  tool  to  assess  the  roll 
modifications  was  the  position  of  the  arm  switch.  If  the  arm  switch  was  on,  the  appropriate  degraded  mode  was 
selected.  If  the  arm  switch  was  off,  then  a  portion  of  the  roll  modification  was  inhibited. 
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Flight  Test  Modes  are  engaged  by: 

1.  Select  desired  pitch,  roll,  or  yaw  mode 

2.  Arm  the  system. 

3.  Engage  with  NWS  switch. 

4.  Disengage  with  autopilot  disengagement  switch. 

Figure  17(a) 

The  following  conditions  can  be  obtained  with  the 
mode  switches  (6.X  series): 


Switch 

Position 

Pitch 

Switch 

Roll 

Yaw 

CAS 

Pitch  CAS  to  stabilator. 

If  yaw  CAS  is  selected: 

Roll  CAS  to  ailerons. 

Roll  CAS  to  stabilators 
if  stabilators  are  not 
in  mechanical. 

If  yaw  DEL  is  selected: 

Rol  digital  DEL  to  ail. 

Roll  digital  DEL  to 
stabilators  if  stabilators 
are  not  in  mechanical. 

Yaw  CAS  to  rudder. 

DEL 

Pitch  digital  DEL 
to  stabilators. 

Digital  DEL  to  ailerons. 

Roll  DEL  to  stabilators  if 
stabilators  are  not  in 
mechanical. 

Yaw  digital  DEL  to 
rudders. 

OFF 

Stabilators  to 
mechanical. 

Roll  CAS  to  stabilators 
if  stabilators  are  not  in 
mechanical. 

Analog  DEL  to  ailerons  and 
rudders. 

Not  available 
switch  position 
blocked. 

Feature  Selected ^  * 

EHBH 

PDEL 

OFF 

Disengage  differential  LEF. 

RCAS  -  OFF 

OFF 

No  reversed  aileron  gain  or 
aileron  disengaged. 

YCAS -  OFF 

OFF 

Differential  TEF  disengaged. 

NOTE:  ID  Features  can  be  selected  individually  or  all 
combination. 


Figure  17(c) 


Figure  17(b) 


Fixed  Flap  Mode:  The  "fixed  flap"  mode  was  originally  intended  to  provide  a  means  to  optimize  the  maneuvering  flap 
schedules  for  cruise  performance.  The  cabability  was  also  used  to  develop  flap  schedules  to  improve  approach  airspeeds 
and  to  improve  departure  resistance  and  spin  recovery  during  the  high  AOA  test  program.  A  modified  version  of  the 
"fixed  flap"  mode  was  used  to  develop  the  active  oscillation  controller.  The  basic  design  and  operation  of  the  "fixed 
flap"  mode  demonstrates  the  flexibility  and  versatility  of  the  FCC-MC  interface  in  the  F/A-18.  The  MC  was 
programmed  to  accept  a  4  X  2  matrix  of  data  information.  In  the  case  of  the  performance  and  high  AOA  testing,  this 
4X2  matrix  consisted  of  four  pairs  of  leading  and  trailing  edge  flap  commands.  In  the  case  of  the  active  controller 


development,  these  fixed  pairs  of  data  corresponded  to  gain 
the  fixed  flap  mode  is  summarized  in  figure  18(a),  Changes 
or  ground  personnel  via  the  Up  Front  Control  as  described  in 

OPERATION  OF  "FIXED  FLAP  MODE" 

1.  Arm  the  "fixed  flap"  mode  via  UFC. 

2.  Select  A,  B,  C,  or  D  setting  on  FCES  display 
(hold  button  until  "ARM"  cue  is  displayed). 

3.  Select  fixed  flap  via  nosewbeel 
steering/designate  button  (look  for  1234  on 
display). 

4.  Deselect  via  autopilot  disengage  switch. 

NOTE:  Four  data  pairs  (A,  B,  C,  and  D)  can  be 
changed  by  pilot  via  UFC  in  flight  or  on  ground. 

Figure  18(a) 


and  phase  shifts  to  a  nominal  bandpass  filter.  Operation  of 
to  the  programmed  settings  could  also  be  made  by  the  pilot 
figure  18(b). 

CHANGING  FIXED  FLAP  DATA 
IN  MISSION  COMPUTER 

1.  Arm  Fixed  Flap  Mode 
Menu  BIT  MI  Unit  28 
Address  31214 

Data  Option 
Address  27650  Enter  1 

2.  Address  Appropriate  6  Digit  Code  for  A,  B,  C,  or 
D  setting. 

3.  Enter  6  Digit  Octal  Code  for  Desired  Flap 
Setting. 


t 


Figure  18(b) 
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These  changes  could  be  implemented  on  the  ground  or  in  flight.  The  mode  could  be  quickly  disengaged  by  depressing  the 
autopilot  disengage  switch  (paddle  switch)  on  the  control  stick.  Safety  was  also  enhanced  by  requiring  the  fixed  flap 
mode  to  be  activated  by  a  discrete  input  and  by  providing  positive  feedback  to  the  pilot  via  the  special  FCS  display 
(figure  18(c)). 


TESTING  THE  ROLL  MODIFICATIONS 

One  of  the  two  areas  of  interest  during  the  flight  test  program  that  particularly  demonstrated  the  utility  of  the 
special  flight  test  control  panel  was  the  testing  of  the  roll  modifications.  As  a  result  of  roll  performance  testing 
conducted  in  the  F/A-18  with  3  series  and  4.1. X  series  PROMS,  several  modifications  and  control  law  changes  were 
incorporated  to  improve  roll  performance  in  the  low  altitude  transonic  flight  regime.  Initial  roll  modifications  included 
increasing  the  wing  stiffness,  extending  the  ailerons  to  the  wingtip,  incorporating  differential  trailing  edge  flap 
capability  (+8  degrees),  increasing  differential  stabilator  deflection  from  20  to  26  degrees,  and  reversing  aileron 
deflection  at  high  dynamic  pressure  flight  conditions.  Use  of  the  special  flight  test  panel  described  previously  allowed 
diagnostic  testing  to  determine  the  effect  on  roll  performance  of  the  differential  trailing  edge  flaps,  the  increased 
differential  stabilator  authority,  and  the  reversal  of  aileron  commands  at  high  dynamic  pressure  flight  conditions. 
Results  of  this  initial  diagnostic  testing  provided  the  data  that  led  to  the  decision  to  delete  the  aileron  reversal  and 
decrease  the  differential  stabilator  authority  in  subsequent  PROM  versions.  Subsequent  to  the  initial  roll  modification 
testing,  further  improvements  in  roll  performance  in  the  high  transonic,  low  altitude  flight  regime  were  still  required. 
Further  testing  involved  investigating  the  use  of  differential  leading  edge  flaps  to  enhance  roll  performance  in  the  area 
of  interest.  The  decision  to  pursue  this  course  of  action  was  prompted  by  analysis  which  indicated  that  the  reduced  roll 
performance  at  high  transonic,  low  altitude  flight  conditions  was  attributable  to  wing  twisting  at  these  high  qc  flight 
conditions.  Differential  deflection  of  the  leading  edge  flaps  reduced  the  adverse  wing  twist  and  resulted  in  improved 
roll  performance.  Initial  testing  involved  performing  360  degree  rolls  with  the  outboard  leading  edge  flaps  prerigged  to 
a  6  degree  differential  deflection.  These  test  results  proved  favorable  and  a  prototype  system  was  designed  and 
implemented  in  an  FSD  aircraft.  Testing  was  accomplished  on  the  prototype  system  with  4.3.2  PROMS.  Diagnostic 
testing  of  the  effect  of  the  differential  leading  edge  flaps  was  also  possible  through  the  special  flight  test  control  panel 
(figure  17(c)).  Results  of  the  diagnostic  testing  of  the  various  roll  modification  evolved  into  the  final  production  roll 
improvement  package  which  consisted  of  increased  wing  stiffness,  extended  ailerons,  and  differential  trailing  and 
leading  edge  flaps.  Provisions  for  the  production  roll  improvements  were  incorporated  in  the  6.X  and  subsequent  PROM 
versions. 

DEVELOPING  THE  ACTIVE  OSCILLATION  CONTROLLER 

The  area  of  flight  testing  that  particularly  demonstrated  the  unique  flexibility  provided  by  the  ’fixed  flap" 
capability  was  the  development  of  the  active  oscillation  controller.  During  the  flutter  test  program  with  external 
stores,  objectionable  low  amplitude  directional  oscillations  (5.6  Hz)  were  observed  at  high  speed/low  altitude  flight 
conditions  when  heavy  stores  (MK  80  series  bombs)  were  carried  on  the  outboard  weapon  stations  (stations  2  and  8)  with 
AIM-9's  on  the  wingtip  stations.  This  phenomena  was  attributed  to  an  asymmetric  store  pitch  mode  that  coupled  with  a 
lateral  fuselage  bending  mode  to  produce  the  resultant  airplane  directional  response  and  lateral  acceleration 
oscillations  perceived  by  the  pilot.  Analysis  of  the  phenomena  indicated  that  the  oscillations  were  affected  by  the 
presence  of  AIM-9's  on  the  wing  tip  weapon  stations  (stations  1  and  9),  leading  edge  and  trailing  edge  flap  deflections, 
and  aileron  deflections.  Based  on  these  observations,  early  fixes  concentrated  on  scheduling  the  leading  edge  flaps  and 
ailerons  to  effectively  eliminate  or  reduce  the  magnitude  of  the  oscillations.  This  approach  resulted  in  schedules  that 
positioned  the  leading  edge  flaps  3  degrees  leading  edge  up  and  the  ailerons  4  degrees  trailing  edge  up.  These  schedules 
were  implemented  in  the  6.0.2  PROMS  and  successfully  reduced,  but  did  not  eliminate,  the  occurrences  of  the  5.6  Hz 
oscillations.  The  resultant  LEF  flap  schedule  also  created  problems  with  in-flight  loads  and  leading  edge  flap  operation. 
Subsequently,  a  decision  to  explore  an  active  oscillation  control  (AOC)  mechanization  was  made.  The  AOC  concept 
involved  using  signals  from  existing  FCS  sensors  to  drive  the  control  surfaces  to  damp  out  the  objectionable  5.6  Hz 
oscillations.  Initial  flight  test  developement  involved  utilizing  a  modified  flutter  exciter  control  unit  (FECU).  This 
FECU  was  used  during  the  flutter  test  program  to  develop  an  analog  filter  to  suppress  the  undesired  oscillations. 
Provisions  for  pilot  selectable  phase  and  gain,  selectable  forward  or  aft  sensor  package  input,  selectable  sensor  input 
(lateral  accelerometer,  yaw  rate  gyro,  or  roll  rate  gyro),  and  selectable  control  surface  (rudder  or  aileron)  were 
implemented  to  suppress  the  oscillations.  Results  of  this  testing  confirmed  the  feasibility  of  using  an  active  controller 
to  suppress  the  oscillations.  Subsequently,  an  analog  system  was  developed  that  used  the  forward  sensor  package  lateral 
accelerometer  signal  to  drive  the  ailerons  at  an  appropriate  gain  and  phase  to  effectively  suppress  the  5.6  Hz 
oscillations. 
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The  basic  analog  system  developed  was  then  implemented  in  a  digital  form  into  a  set  of  flight  control  law  PROMS 
(7. 1.3.1).  The  general  form  of  the  filter  implemented  into  the  production  PROMS  including  a  corresponding  bode  plot  is 
presented  in  figure  19.  A  pilot  selectable  Dial-a-Gain  and  Dial-a-Phase  capability  was  also  implemented  via  the  "fixed 
flap"  mode  discussed  earlier.  The  Dial-a-Gain  and  Dial-a-Phase  capability  provided  a  means  to  fine  tune  the  gain  and 
phase  of  the  filter  implemented  in  the  control  laws.  The  first  change  resulting  from  testing  the  initial  digital  design  was 
to  change  from  a  7th  order  to  a  5th  order  bandpass  filter  to  provide  less  phase  variation  across  the  frequency  range  of 
interest  (5  to  6  Hz).  Additional  refinements  were  required  to  optimize  the  filter  for  a  range  of  external  loadings.  A 
decision  to  activate  the  system  only  for  MK  80  series  bombs  on  the  outboard  stations  was  made  since  test  results  with 
lighter  external  stores  showed  that  the  active  controller  tended  to  amplify  instead  of  attenuate  the  oscillations.  This 
required  interfacing  the  controller  with  the  stores  management  set  via  the  MC  and  1553  multiplex  bus.  The  final  filter 
implemented  represents  a  compromise  for  the  MK  80  series  bombs  external  loadings  tested  that  still  provided  adequate 
suppression  of  the  5.6  Hz  oscillations. 


NOTE:  MNETUNMMTHE  FILTER  INVOLVED  CHMMIIM 
THE  K  AND  T.  VALUES  VIA  THE  "WAi-A-OAIN" 
CAPABILITY 


Figure  19  General  Form  of  the  Production  Bandpass  Filter 


FCS  SPIN  RECOVERY  MODE  DESIGN  EVOLUTION 


INITIAL  CONCEPTS 

During  the  initial  design  stages  of  the  F/A-18,  a  great 
deal  of  emphasis  was  placed  upon  achieving  a  design  that 
would  possess  a  high  degree  of  departure  and  spin 
resistance.  The  YF-17  which  was  the  prototype  for  the 
F/A- 18  was  known  to  possess  excellent  high  AOA  flying 
qualities  and,  as  such,  the  basic  aerodynamic  design  was 
chosen  as  a  basis  for  that  of  the  F/A-18.  A  comparison  of 
the  original  and  current  F/A-18  aerodynamic 
configuration  is  illustrated  in  figure  20.  The  normal 
operating  mode  of  the  FCS  is  the  Control  Augmentation 
System  Mode  (CAS).  The  CAS  Mode  augments  the  natural 
aerodynamic  stability  via  control  surface  authority 
limiting  and  use  of  feedback  control  concepts. 

Although  lateral-directional  control  law  features  in  the  CAS  mode  enhance  departure/spin  resistance,  they  also  reduce 
control  power  available  for  spin  recovery.  For  this  reason,  an  automatic  spin  recovery  mode  (ASRM)  was  incorporated 
in  the  FCS.  When  engaged,  the  ASRM  provides  the  pilot  with  full  control  surface  authority  regardless  of  the  AOA  and 
opens  all  feedback  loops  to  provide  full  antispin  control  authority  for  spin  recovery. 

Automatic  Spin  Recovery  Mode  -  Initial  Design:  Establishing  safe  automatic  spin  recovery  mode  (ASRM) 
engagement/disengagement  thresholds  was  a  major  consideration  before  commencement  of  actual  flight  tests.  The 
design  goal  with  respect  to  ASRM  logic  was  to  establish  engagement  thresholds  which  were  not  so  low  as  to  reduce 
departure/spin  resistance  but  not  so  high  as  to  prevent  recovery  from  a  spin.  Disengagement  logic  was  designed  such 
that  the  FCS  would  revert  to  CAS  (i.e.,  the  normal  operation  FCS  mode)  during  the  final  stages  of  spin  recovery.  While 
in  the  ASRM,  all  feedbacks  and  control  surface  limits  are  removed  to  provide  maximum  antispin  control  authority.  It  is 
important  to  note  that  pilot  spin  recovery  control  inputs  are  still  required  in  the  ASRM.  The  ASRM  does  not 
automatically  apply  antispin  control  inputs.  During  the  F/A-18  high  AOA/spin  FSD  program,  ASRM  logic  required 
changes  as  more  knowledge  was  gained  on  F/A-18  spin  modes.  Initial  ASRM  engagement/disengagement  logic  was  as 
shown  in  figure  21. 


•  ENGAGEMENT  —  YAW  RATE  >3SDEO/BEC; 
TIME  >  8  SEC 


•  DISENGAGEMENT  —  YAW  RATE  S  18  DEG/ 
SEC 


r1- 


Figure  21  Original  ASRM  Logic 
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During  the  early  stages  of  the  high  AOA  program,  the  primary  focus  of  testing  was  evaluation  and/or  verification 
of  strong  departure  and  spin  resistance.  Concurrent  National  Aeronautics  and  Space  Administration  (NASA)  F/A-18 
drop  model  spin  test  results  established  a  requirement  to  increase  the  ASRM  engagement/disengagement  yaw  rate 
thresholds.  The  basis  for  this  change  was  a  MIL-F-8785B  specification  requirement  that  departure  resistance  be 
determined  by  holding  sustained  prospin  control  inputs  for  at  least  15  seconds.  NASA  model  testing  showed  that  with 
ASRM  35/15  degree/second  yaw  rate  engage/disengage  thresholds  a  potential  for  inadvertent  ASRM  engagement  existed 
when  sustained  prospin  controls  were  held  for  15  seconds.  As  a  result,  ASRM  engage/disengage  thresholds  were 
increased  as  shown  in  figure  22. 

•  ENGAGEMENT  —  YAW  RATE  >  50  DEG/  •  DISENGAGEMENT  —  YAW  RATE  <  30  DEG/ 

SEC;  TIME  >  5  SEC  8EC 

Figure  22  Revised  ASRM  Logic 

F/A-18  SPIN  ACCIDENT 

On  14  November  1980,  an  F/A-18  crashed  as  a  result  of  a  departure  that  progressed  into  a  low  yaw  rate  spin,  which 
apparently  had  yaw  rates  with  magnitudes  which  were  less  than  required  to  engage  the  ASRM  (50  degrees/second  yaw 
rate).  The  FCS  remained  in  the  Control  Augmentation  System  (CAS)  mode.  Consequently,  insufficient  control  authority 
was  available  for  the  pilot  to  achieve  recovery.  To  prevent  reoccurrence  of  these  conditions,  a  cockpit  mounted  spin 
recovery  mode  switch  was  installed  which  permitted  manual  engagement  of  the  spin  recovery  mode.  The  manual  spin 
recovery  mode  (MSRM)  switch  was  installed  as  an  interim  fix  until  such  time  that  the  safety  and  effectiveness  of  new 
automatic  spin  recovery  mode  logic  could  be  verified.  The  MSRM  switch  was  also  installed  in  the  spin  test  airplane  to 
permit  intentional  spin  testing  for  determination  of  optimum  spin  recovery  control  procedures. 

Spin  Accident  Ramifications:  The  loss  of  an  F/A-18  in  an  apparent  low  yaw  rate  spin  had  a  dramatic  impact  on  the 
subsequent  course  of  the  high  AOA  test  program.  Prior  to  the  accident,  the  major  emphasis  of  testing,  as  previously 
noted,  was  on  evaluation  of  departure  and  spin  resistance.  Postaccident  testing  was  expanded  to  identify  all  spin  modes 
and  to  determine  optimum  spin  recovery  techniques.  In  retrospect,  it  is  clear  that  because  of  the  F/A-18  spin  accident 
and  subsequent  FSD  spin  testing,  significantly  more  is  known  about  F/A-18  spin  modes,  spin  recovery  characteristics, 
and  operation  of  the  FCS  at  high  AOA  than  would  be  otherwise.  In  particular,  as  a  result  of  intentional  spin  testing,  the 
low  yaw  rate  spin  mode  was  identified  which  is  believed  to  have  been  responsible  for  the  spin  accident.  In  this  regard, 
initial  analytical  high  AOA  simulations  and  spin  tunnel  model  testing  did  not  predict  the  existence  of  this  mode  as 
illustrated  in  figure  23.  An  example  of  an  actual  low  yaw  rate  spin  is  presented  in  figure  24. 


Figure  23  Predicted  Maneuver/Spin  Figure  24  Low  Yaw  Rate  Spin 

Boundaries  Versus  Flight  Test 


A  contributing  factor  for  no  prediction  of  the  low  yaw  rate  spin  mode  may  have  been  uncertainty  in  the  high  AOA 
aerodynamic  data  base  (rotary  derivative  data  were  not  available)  used  to  generate  the  F/A-18  high  AOA  simulation. 
Although  one  of  the  high  AOA  piloted  simulations  (based  upon  16%  model  data)  predicted  a  low  yaw  rate  spin  mode 
approximately  1  year  prior  to  the  accident,  there  was  not  enough  confidence  in  the  data  base  to  lower  the  automatic 
spin  recovery  mode  engagement  yaw  rate  threshold.  This  reluctance  may  have  been  due  to  the  excellent  departure  and 
spin  resistance  exhibited  by  the  F/A-18  up  to  that  point  in  time  and  because  of  uncertainty  in  the  aerodynamic  data 


FINAL  CONCEPTS 

FCS  Spin  Recovery  Mode!  As  discussed  earlier,  the  F/A-18  FCS  was  to  have  only  an  automatic  reversion  to  spin 
recovery  mode  capability.  However,  as  previously  noted  a  cockpit  mounted  manual  spin  recovery  mode  switch  was 
incorporated  as  a  result  of  the  spin  accident  in  November  1980.  Evolution  of  spin  recovery  mode  logic  for  both  the 
manual  and  automatic  SRM  is  summarised  next. 


Manual  SRM  Logic:  Manual  SRM  engagement/disengagement  threshold/logic  is  summarized  in  figure  25. 


•  ENGAGE  LOGIC  -  SWITCH  ON  AND  •  DISENGAGE  LOGIC  -  SWITCH  OFF  OR 

<180  KIAS  >850  KIAS 

Figure  25  Manual  SRM  Logic 

During  the  design  of  the  manual  SRM,  there  was  a  great  deal  of  effort  made  to  insure  that  the  air  data  system  failures 
previously  experienced  during  FSD  flying  qualities  tests  due  to  sideslip  at  high  airspeed  not  occur  during  spin  testing. 
This  was  necessary  because  reversion  to  the  fixed  gains  mode  of  the  FCS  would  prevent  manual  engagement  of  the 
SRM.  This  air  data  failure  logic  was  selected  because  engagement  of  spin  logic  at  high  dynamic  pressure  would  result  in 
unacceptably  sensitive  and  possibly  dangerous  aircraft  response  to  pilot  control  inputs.  One  of  the  initial  assumptions 
made  was  that,  during  a  spin,  the  total  dynamic  pressure  would  be  so  low  that  dynamic  pressure  differences  between 
left  and  right  pitot-static  probes  could  not  exceed  the  preset  failure  monitor  thresholds.  However,  during  asymmetric 
load  spin  testing  this  assumption  proved  to  be  incorrect.  During  a  12,000  ft-lb  asymmetric  load  spin,  the  difference  in 
left  and  right  Qc.  exceeded  the  preset  failure  (AQC.)  thresholds,  thereby  causing  reversion  to  fixed  gains  and  preventing 
spin  recovery  until  the  failure  cleared  and  the  Fct  was  manually  reset.  Subsequent  analysis  revealed  that,  during  the 
spin,  the  magnitude  of  sideslip  was  such  that  one  of  the  L-probe  pitot-static  heads  was  registering  negative  dynamic 
pressure.  As  a  result,  the  large  A Qc .  indication  caused  an  air  data  failure  and  prevented  access  to  the  manual  SRM.  The 
air  data  system  failure  monitoring  logic  was  subsequently  changed  so  that  only  positive  Qc.  pressure  indications  are 
used  to  compute  A Qc  mismatch  values,  and  reasonable  range  thresholds  were  expanded  to  allow  negative  values.  Also, 
both  left  and  right  Qc.  values  must  fail  reasonable  range  checks  before  a  failure  is  declared.  Excessive  differences 
between  left  and  right  dynamic  pressure  signals  will  generate  a  pilot  caution  but  are  no  longer  used  to  declare  an  air 
data  failure.  During  asymmetric  load  spin  testing,  reversion  to  fixed  gains  also  occurred  because  of  larger  than 
expected  values  of  left  and  right  L-probe  static  pressures  due  to  large  sideslip.  Left  and  right  static  pressure  lines  are 
now  joined  to  eliminate  that  failure  mode. 

Auto-SRM  Logic:  As  described  earlier,  the  original  SRM  logic  automatically  reverted  to  the  SRM  if  yaw  rate  exceeded 
35  degree/second  for  >5  seconds.  Automatic  reversion  to  the  CAS  mode  occurred  if  yaw  rate  decreased  to  less  than 
15  degree/second.  As  previously  noted,  engage/disengage  yaw  rate  thresholds  were  subsequently  changed  to  50  and 
30  degree/second,  respectively,  to  increase  departure/spin  resistance  and  to  preclude  inadvertent  SRM  engagement 
during  aggressive  maneuvering-  The  need  to  further  modify  automatic  SRM  logic  was  recognized  because  of  the  low  yaw 
rate  spin  mode  identified  during  spin  tests  subsequent  to  the  November  1980  spin  accident.  The  ultimate  goal  was  to 
replace  the  manual  spin  recovery  mode  switch  with  automatic  SRM  logic.  Current  automatic  SRM  logic  is  outlined  in 
figure  26.  This  system  has  been  extensively  tested  and  has  provided  excellent  spin  recovery  capability.  However, 
additional  testing  is  required  to  perfect  the  system  to  the  point  at  which  the  manual  SRM  switch  can  be  removed.  A 
unique  feature  of  current  automatic  SRM  logic  is  that  it  provides  full  antispin  control  authority  only  if  lateral  stick  is 
moved  in  the  correct  direction.  The  FCS  automatically  reverts/fades  back  to  the  CAS  mode  if  prospin  lateral  stick  is 
applied. 

•  iwoaoe  mate — axmeno  <i«o  kia« 
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Figure  26  Current  Automatic  SRM  Logic 

Spin  Recovery  Displays;  Both  manual  and  automatic  SRM 
logic  also  provide  the  pilot  with  spin  recovery  mode  status 
information  on  the  cockpit  digital  display  indicators  (see 
figure  27).  These  displays  are  specifically  designed  to  provide 
the  pilot  with  the  information  he  needs  to  achieve  spin 
recovery.  Display  information  is  programmed  to  appear  on 
both  of  the  cockpit  Digital  Display  Indicators  (DDLs).  The 
DDTs  are  located  on  the  right  and  left  upper  portions  of  the 
instrument  panel.  Normally,  the  DDTs  are  used  to  display 
weapon  system  information  (radar,  FLIR,  Store  Management, 
etc).  However,  in  an  out  of  control  situation,  the  spin 

recovery  displays  have  maximum  priority  and  are 

automatically  substituted  in  place  of  other  display 

information  which  may  be  present.  The  spin  recovery 

displays  are  designed  to  provide  the  pilot  with  two  essential 
pieces  of  information:  (a)  SRM  engage/disengage  status  and 
(b)  antispin  flight  control  instructions.  These  displays  have 
tremendous  potential  for  the  F/A-18  and  for  future  aircraft  designs  in  that  they  allow  the  pilot  to  make  an  optimum 
spin  recovery  without  having  to  determine  the  type  or  direction  of  spin  or  to  recall  the  correct  antispin  controls.  One 
significant  problem  associated  with  SRM  display  information  that  has  been  identified  occurs  during  highly  oscillatory 
spins.  During  intermediate  yaw  rate  oscillatory  spins,  the  F/A-18  will  on  occasion  roll  360  degrees  while  continuing  to 
spin  in  the  established  direction.  During  the  roll,  normal  acceleration  and  body  axis  yaw  rate  change  sign  and  the  spin 
recovery  display  arrows  momentarily  change  direction  and  point  in  the  wrong  direction.  Review  of  test  data  indicates 
that  momentary  (i.e.,  less  than  1  second)  incorrect  spin  recovery  arrow  direction  occurs  when  the  sign  of  raw  yaw  rate 
or  raw  normal  acceleration  is  opposite  to  that  of  their  respective  filtered  values  (filtered  values  are  used  in  SRM  logic). 
However,  it  is  important  to  emphasize  that  the  automatic  SRM  has  operated  satisfactorily  during  spin  tests  of  the 
F/A-18  and,  as  such,  serious  consideration  should  be  given  to  employing  this  concept  in  future  advanced  tactical 
aircraft. 
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Figure  27  Spin  Recovery  Mode  Display 
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HIGH  AOA/AIR  DATA  SYSTEM  FAILURE  MONITORING 


AOA  System:  The  F/A-18  has  AOA  probes  located 
symmetrically  on  each  side  of  the  forward  fuselage  as 
illustrated  in  figure  20.  AOA  information  is  utilized  by 
both  flight  control  and  mission  computers  as  illustrated 
in  figure  28. 

The  FCS  converts  the  two  signals  from  each  probe 
(total  of  four  electrical  signals)  to  digital  quantities  and 
through  a  voting  logic  computes  the  AOA  signal  to  be 
used  for  control  law  computations.  A  correction  factor 
is  applied  to  the  local  AOA  signal  to  give  an 
approximation  to  true  AOA  to  be  used  in  control  law 
computations.  The  range  of  the  AOA  probes  is  -14  to 
+56  degrees  indicated  AOA.  Above  37  degrees  true 
AOA,  the  INS  is  used  to  compute  AOA's  up  to 
90  degrees.  This  information  is  displayed  to  the  pilot  on 
the  HUD. 

AOA  Failure  Monitoring:  AOA  failure  monitoring  logic 
changed  considerably  during  FSD  testing.  Evolution  of 
AOA  failure  detection  logic  is  briefly  summarized  in 
table  m.  Mismatch  tolerances  between  left  and  right 
AOA  probes  progressively  increased  to  prevent  nuisance 
reversions  of  the  FCS  to  the  "fixed  gains"  mode.  In  the 
fixed  gains,  LEF's  and  TEF's  are  locked  in  position  at 
time  of  failure  while  the  FCS  remains  in  the  CAS 
mode.  One  of  the  first  surprises  of  the  FSD  high  alpha 
program  occurred  during  departure  resistance  testing. 
During  a  departure  at  high  subsonic  Mach  number, 
unexpectedly  large  mismatches  in  left  and  right  AOA 
vane  indications  were  of  sufficient  magnitude  and 
duration  to  cause  reversion  of  the  FCS  to  fixed  gains. 
Upon  reverting  to  fixed  gains,  the  leading  edge  flaps 
which  should  have  locked  in  position  at  the  time  of 
failure,  instead  retracted,  with  the  airplane  in  an 
unrecoverable  poststall  gyration.  Recovery  was  delayed 
until  the  AOA  failure  cleared  and  the  pilot  manually 
reset  the  FCS  to  CAS.  Revised  control  laws 
subsequently  increased  the  AOA  failure  detection 
magnitude  and  duration  thresholds  and  changed  LEF 
control  mechanization  to  prevent  LEF'S/TEF'S  from 
being  driven  to  unusual/off  schedule  positions.  An 
anto-reset  FCS  capability  was  also  incorporated  in  the 
FCS  together  with  inhibiting  of  AOA  failure  monitoring 
at  low  airspeed. 

Air  Data  System:  The  FCS  contains  two  dedicated  dual 
channel  pneumatic  pressure  sensors  called  Backup  Air 
Data  Sensor  Assemblies  (BADSA's).  The  filtered, 
uncalibrated  sensor  outputs  are  used  for  all  inner  loop 
control  law  gain  scheduling.  Pneumatic  inputs  are 
supplied  to  the  BADSA's  and  other  aircraft  systems  by 
two  L -shaped  pitot-static  probes  that  are  located 
symmetrically  on  the  lower  forward  fuselage.  Each 
L-probe  has  two  static  and  one  pitot  pressure  output. 
Each  channel  of  the  BADSA  contains  an  absolute 
pressure  transducer  which  measures  static  pressure  and 
a  differential  pressure  transducer  which  measures 
dynamic  pressure  (pitot  pressure-static  pressure).  The 
air  data  system  configuration  is  illustrated  in  figure  29. 
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Figure  28  AOA  System  Configuration 


Table  m 


AOA  Failure  Monitoring  Evolution 


Tolerance/Threshold 

AOA 

Mismatch 

(deg) 

Time 

Constant 

R.nirki111 

Control 

Law 

Version 

3.5 

0.5 

Original  tolerance /threshold. 

3.11 

5.0 

1.0 

Precludes  FCS  reversions  to 
fixed  gains  due  to  sideslip. 

3.12 

15.0 

1.0 

Precludes  FCS  reversions  to 
fixed  gains  due  to  sideslip. 

3.21 

15.0 

10.0 

AOA  15  deg 

4.3 

30.0 

10.0 

AOA  45  deg 

15.0 

5.0 

Auto-reset  of  failure  if  AOA 
in  reasonable  range.  AOA 
failure  monitoring  inhibited 
at  less  than  100  kt. 

6.X-8.X 

NOTE:  (1)  In  "fixed  gains"  the  FCS  remains  in  the  CAS  mode 
with  nominal  gains  used  by  the  flight  control  laws. 


Figure  29  Air  Data  System 

Air  Data  Failure  Monitoring!  With  current  control  laws,  an  air  data  failure  is  declared  only  if  both  BADSA's  fail 
reasonable  range  checks.  If  both  BADSA's  are  in  range,  then  the  data  from  the  BADSA  with  the  highest  dynamic 
pressure  is  used  by  the  control  laws.  When  an  air  data  failure  occurs,  the  FCS  reverts  to  the  fixed  gains  mode.  During 
contractor  FSD  asymmetric  stores  high  AOA  spin  testing,  reversions  to  fixed  gains  occurred  as  a  result  of  unexpectedly 
large  sustained  sideslip  excursions  which  caused  excessive  differences  between  left  and  right  static  and  dynamic 
pressure  signals.  These  results  had  a  significant  impact  on  spin  recovery  capability  as  discussed  in  a  previous  section  of 
this  paper  (see  Manual  SRM  Logic). 
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HIGH  AOA  FCS  DESIGN  LIMITATIONS 


One  design  area  in  which  F/A-18  FCS  design 
limitations  become  evident  occurs  at  high  AOA  where 
nosedown  pitch  restoring  moment  requirements  must  be 
met.  In  March  1980,  the  wing  leading  edge  extension 
(LEX)  slots  were  closed  to  improve  supersonic 
performance  capability.  However,  closure  of  the  LEX 
slots  had  a  significant  adverse  affect  on  pitch  restoring 
moment  capability  at  approximately  SO  degrees  AOA.  The 
zero  pitch  restoring  moment  CG  was  shifted 
approximately  5%  forward  (equivalent  to  approximately 
0.1  ACM)  as  illustrated  by  figure  30.  This  has  caused 
delayed  recoveries  from  high  AOA  flight  conditions  or 
AOA  hang-up  as  illustrated  in  figure  24.  Also  noted  in 
figure  30  are  apparent  scale  effect  differences  on  pitch 
restoring  moment  wind  tunnel  predictions  between  6  and 
16%  models.  Full  scale  development  testing  indicated  that 
delayed  recoveries  from  nose  high  -  low  airspeed  flight 
conditions  and  from  oscillatory  spins  were  being 
occasionally  encountered.  At  aft  CG's  and  in  the  50  to 
60  degree  AOA  region,  the  airplane  did  not  always 
respond  immediately  to  neutral  longitudinal  controls  or 
application  of  full  forward  stick.  Subsequent  flight  testing 
was  performed  to  identify  the  CG's  at  which  these 
conditions  (i.e.,  AOA  hang-up)  occurred  for  several 
external  store  loadings.  The  effect  of  aft  CG's  in  the 
F/A-18  on  AOA  hang-up  recovery  is  illustrated  in 
figure  31,  which  shows  that  under  these  conditions  full 
.railing  edge  down  stabilator  may  not  be  sufficient  to 
recover  from  a  high  AOA  condition.  As  expected,  the 
addition  of  external  wing  stores  further  reduced  recovery 
capability  by  shifting  the  zero  pitch  restoring  moment  CG 
as  much  as  4%  forward  as  compared  with  the  fighter 
escort  loading  (wing  tip  and  fuselage  missiles  only). 
Interim  solutions  toward  avoiding  AOA  hang-up  flight 
conditions  include  modified  fuel  sequencing  to  shift  the 
CG  forward  (approximately  2%)  and  imposition  of 
AOA/Mach  number  and  CG  placards  to  keep  the  airplane 
from  entering  the  AOA  hang-up  region  and  to  assure 
adequate  recovery  control  power  should  AOA  hang-up 
flight  conditions  be  inadvertently  encountered.  A 
promising  aerodynamic  modification  that  has  been 
designed  by  McDonnell  Douglas  and  evaluated  by  NASA 
Langley  Research  Center  involves  a  reduction  in  area  of 
the  wing  leading  edge  extension  as  illustrated  in  figure  32. 
Wind  tunnel  test  results  (16%  scale  model)  indicate  that, 
in  the  AOA  hang-up  region,  a  5%  aft  shift  in  CG  position 
for  zero  pitch  restoring  moment  would  be  realized  with 
the  modified  LEX  as  illustrated  in  figure  32. 


Figure  31  Aft  CG  AOA  Hang-Up  Recovery  Effect 


FCS  design  changes  can  have  significant  limitations  with  regard  to  correcting  flying  qualities  deficiencies  particularly 
at  high  AOA.  In  some  cases  a  relatively  small  aerodynamic  design  change  may  be  a  better  and  possibly  the  only  solution 
to  a  flying  qualities  deficiency  as  opposed  to  a  FCS  design  change  for  the  same  purpose. 

CONCLUSION 

The  development  of  the  F/A-18  control  laws  and  specialized  displays  has  been  a  major  stepping  stone  in 
demonstrating  the  powerful  flexibility  and  versatility  of  a  digital  FCS  as  an  integral  part  of  a  total  avionics  system. 
The  digital  design  and  interface  of  the  FCS  with  the  MC  and  pilot  displays  has  been  instrumental  in  improving  F/A-18 
overall  handling  qualities,  suppressing  undesirable  structural  oscillations,  developing  high  AOA  departure  resistance  and 
spin  recovery  control  laws,  and  in  developing  the  associated  unique  pilot  displays  which  have  significantly  reduced  pilot 
workload  and  assisted  in  spin  recovery.  The  flexibility  and  versatility  inherent  in  the  F/A-18  FCS  design  has  permitted 
the  implementation  of  unique  methods  to  practicably  effect  required  changes  and  to  refine  aqd  develop  these  changes  in 
a  real-time  flight  test  environment.  The  digital  design  and  integration  of  the  FCS  into  the  overall  avionics  package  of  a 
given  aircraft  has  and  will  be  continually  expanded  in  present  and  future  generation  aircraft.  Testing  of  these  new 
systems  can  be  greatly  assisted  by  utilizing  their  inherent  flexibility  throughout  the  flight  test  program 
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LESSONS  LEARNED  IN  THE  DEVELOPMENT  OF  THE 
F-16  FLIGHT  CONTROL  SYSTEM 

Dr.  Carl  S.  Droste 
Manager,  Flight  Control  Systems 
General  Dynamics 
Fort  Worth  Division 
P.O.  Box  748 
Mail  Zone  2838 
Fort  Worth,  Texas  USA  76101 


SUMMARY 

Flight  control  systems  engineers  have  always  been  pioneers  in  design  to  achieve 
"survivability  after  failure".  Historically ,  this  capability  has  been  accomplished  by 
duplicating  the  functions  of  the  flight  control  system  and  employing  redundancy  manage¬ 
ment  to  detect  failures  and  to  reconfigure  for  safe  operation  within  an  acceptable  pro¬ 
bability.  Protection  against  failure  by  redundancy  always  results  in  a  design  trade 
between  reliability  (mean  time  between  failure)  and  safety  (mean  time  between  castrophic 
loss).  Fortunately,  improvements  in  hardware  reliability  have  kept  pace  with  increased 
system  complexity,  and  redundant  systems  have  become  the  norm  in  all  modern  flight  con¬ 
trol  systems  on  high-technology  military  aircraft. 

‘The  Fort  Worth  Division  of  General  Dynamics  has  been  heavily  involved  with 
failure-tolerant  flight  control  systems  for  almost  20  years  through  production  of  the 
F-lll  and  the  F-16.  The  need  for  survivability  after  failure  is  most  obvious  on  the 
F-16,  which  has  the  world's  first  production  fly-by-wire  flight  control  system.  Fly¬ 
by-wire  is  an  absolute  necessity  on  the  F-16  because  the  aircraft  was  designed  to  be 
statically  unstable  and  cannot  be  controlled  without  the  artificial  stability  provided 
by  the  flight  control  system.  The  well  over  250,000  flight  hours  on  the  F-16  have 
provided  several  lessons  that  are  not  readily  apparent  on  programs  not  in  a  production 
environment.  The  analytical  system  failure  probabilities  predicted  by  traditional 
analysis  for  random  failures  have  been  essentially  proven.  However,  one  fallacy  in 
this  traditional  analysis  must  still  be  overcome.  '-Because  of  difficulties  in  analytical 
definition,  several  external  factors  may  not  be  included  in  the  failure  analysis  of 
flight  control  systems.  These  factors,  although  not  directly  a  part  of  the  flight 
control  system,  can  render  redundancy  useless  if  not  considered.  Examples  of  these 
external  factors  are  pilot  interface,  ground  maintenance,  structural  resonance,  environ¬ 
mental  conditions,  indirect  electrical  hazards,  and  other  system  failures.  These  fac¬ 
tors  are  not  unique  to  the  F-16  but  are  common  to  all  aircraft  with  fly-by-wire  flight 
control  systems.  This  paper  discusses  examples  of  how  several  of  these  factors  mani¬ 
fested  themselves  in  the  development  of  the  F-16  and  how  the  F-16  flight  control  system 
has  evolved  to  minimize  their  effect.  One  of  the  most  significant  evolutions  to  aid  in 
the  isolation  and  resolution  of  problems  is  the  time  sequenced  data  provided  by  the  F-16 
maintenance  memory. 

/ 


GENERAL  DESCRIPTION  OF  THE  F-16  FLIGHT  CONTROL  SYSTEM 

The  F-16  fly-by-wire  Flight  Control  System  (FLCS)  consists  of  many  interacting 
components,  as  illustrated  in  Figure  1.  Pilot  commands  to  the  FLCS  are  generated  by  a 
sidestick  controller,  rudder  pedals,  and  switches  in  the  flight  control  panels.  The 
electrical  commands  from  these  cockpit  components  are  fed  to  the  Flight  Control  Computer 
(FLCC) ,  which  can  be  viewed  as  the  "heart"  of  the  FLCS.  The  FLCC  also  receives  air¬ 
craft  inertial  motion  inputs  from  pitch,  roll,  and  yaw  gyro;  and  from  normal  and  lateral 
accelerometers.  Additionally,  air  data  information  is  transmitted  to  the  FLCC  after 
measurement  by  total  pressure,  static  pressure,  and  angle-of-attack  (AOA)  probes;  con¬ 
version  of  pneumatic  pressure  to  electrical  signals  by  the  Pneumatic  Sensor  Assembly 
(PSA);  and  signal  conditioning  by  the  Electronic  Component  Assembly  (ECA) .  The  FLCC 
combines  these  inputs  through  appropriate  control  laws  to  produce  control-surface  com¬ 
mands  that  position  five  primary  control  surfaces  through  Integrated  Servoactuators 
(ISAs) .  Primary  control  surfaces  are  defined  as  two  f laperons ,  two  all-moveable  hori¬ 
zontal  tails,  and  a  rudder.  The  FLCS  provides  information  back  to  the  pilot  through 
various  indicator,  caution,  and  warning  lights  located  in  the  cockpit. 

The  F-16  also  incorporates  several  secondary  control  surfaces  -  the  leading-edge 
flap  and  speed  brakes.  The  leading-edge  flap  is  driven  by  a  power  drive  unit  that  is 
programmed  by  the  ECA  as  a  function  of  AOA,  altitude,  and  Mach  number  to  provide  opti¬ 
mum  wing  contour  during  maneuvering.  The  two  speed  brakes  are  directly  controlled  by 
the  pilot. 
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From  the  very  beginning,  General  Dynamics  decided  to  take  advantage  of  the  reduced 
drag  and  lower  weight  provided  by  designing  the  F-16  to  be  statically  unstable  at  sub¬ 
sonic  speeds  (up  to  10  percent  MAC  for  low  angles  of  attack).  With  this  decision  came 
the  need  for  artificial  stability  provided  by  the  FLCS.  The  FLCS  must  be  designed  with 
high  reliability  and  fault  tolerance  because  flight  characteristics  are  such  that  the 
pilot  could  not  fly  the  F-16  without  artificial  stability.  Since  aircraft  safety  is 
totally  dependent  on  the  electronic  artificial  stability  system,  the  need  for  mechanical 
linkage  is  eliminated.  Pilot  commands  can  be  electrically  fed  into  the  FLCS  like  the 
other  critical  inputs. 


PROTECTION  AGAINST  FLCS  FAILURE 

The  F-16,  like  most  modern  high-performance  aricraft,  is  protected  against  FLCS 
failure  in  three  ways : 

1.  High  reliability 

2 .  Redundancy 

3.  Built-in  Test. 

To  protect  against  system  failures,  it  is  fundamental  to  make  the  mean  time  between 
failure  (MTBF)  as  long  as  possible  through  high  reliability  of  system  components.  How¬ 
ever,  for  many  cases  in  complex  flight  control  systems,  component  reliability  cannot 
be  made  high  enough  to  eliminate  the  need  for  system  tolerance  of  component  failure  by 
some  sort  of  failure  detection  and  correction  scheme.  On  the  F-16,  protection  against 
failure  is  achieved  by  redundancy.  Critical  functions  are  replicated  up  to  four  times 
in  the  FLCS.  In  the  event  of  consecutive  component  failures,  the  system  can  sense  the 
error  by  comparison  of  redundant  branches  and  then  provide  a  valid  output  command  by  a 
selection  process. 

The  F-16  FLCS  also  employs  built-in  self  test  to  protect  against  failure.  Inherent 
in  the  design  of  the  redundancy  management  system  is  the  assumption  that  it  is  working 
properly.  One  of  the  primary  functions  of  built-in  self  test  is  to  check  the  capabi¬ 
lity  of  the  redundancy  management  system  to  detect  and  correct  failures.  Of  course, 
self  test  is  also  designed  to  detect  failures  in  the  redundant  branches  prior  to  flight. 


THE  F-16  REDUNDANCY  MANAGEMENT  SYSTEM 

Redundancy  level  is  a  te*rra  that  is  used  in  failure-tolerant  systems  as  an  indica¬ 
tion  of  the  amount  of  failure  protection  provided.  A  redundant  system  is  one  where 
various  system  functions  are  replicated  so  that  failures  in  the  system  can  be  detected 
and  corrected  by  use  of  alternate  paths. 

The  level  of  failure  protection  for  redundant  systems  is  classified  by  the  number 
of  like  failures  that  can  be  sustained  without  loss  of  function.  Fail-operational  sys¬ 
tems  can  withstand  one  failure.  Two-fail-operational  systems  can  stand  two  consecutive 
like  failures. 

Another  term  used  relative  to  failure  protection  is  fail-safe.  A  fail-safe  system 
suffers  degradation  on  failure,  but  the  degradation  does  not  prevent  safe  operation. 

In  an  aircraft  flight  control  system  fail-safe  means  the  pilot  can  return  the  aircraft 
and  land  safely. 

Many  factors  influenced  the  redundancy  level  and  failure  protection  selected  for 
the  F-16.  Two  of  the  most  important  factors  to  be  remembered  about  redundancy  are  that 

1.  Redundancy  (failure  protection)  reduces  the  chance  of  catastrophic  failure. 

2.  Redundancy  decreases  reliability,  may  increase  the  probability  of  takeoff 
aborts,  and  increases  costs. 

The  relative  importance  of  these  two  factors  is  a  driving  influence  in  the  selection  of 
the  proper  protection  level. 

The  selection  of  redundancy  and  failure  protection  is  influenced  by  other  factors 
in  addition  to  safety  probability,  reliability,  and  cost.  Some  of  the  more  significant 
factors  are 

o  Emotional  acceptability  by  system  users  based  on  previous  experience  with  other 
systems . 

o  MTBF  of  mature  versus  new  hardware. 


o  Physical  geometry  of  the  airplane. 

o  Interface  compatibility  with  other  parts  of  the  system. 

On  the  YF-16  and  F-16  fly-by-wire  FLCS,  the  redundancy  level  varies  from  none  to 
quadruple,  and  failure  protection  varies  from  none  to  two-fail-operative/fail-safe. 

The  interrelationships  among  the  F-16  redundancy  and  failure  protection  levels  are 
shown  in  Figure  2. 

The  highest  failure  protection  used  on  the  F-16  is  in  the  quadruple-redundant 
flight  control  computer  (FLCC) .  This  redundancy  level  provides  two-fail-operative  pro¬ 
tection  in  the  pitch  axis  and  two-fail-operative/fail-safe  protection  in  the  roll  and 
yaw  axes.  One  of  the  most  significant  factors  considered  on  the  F-16  was  the  accepted 
failure  protection  levels  on  other  high-performance  aircraft  flying  in  1972.  The  F-lll 
is  typical  of  these  aircraft.  The  FCS  on  the  F-lll  is  a  single-fail-operational  elec¬ 
tronic  system  in  conjunction  with  a  full-time  mechanical  system.  The  logical  reaction 
to  removing  the  mechanical  system  on  the  F-16  was  to  increase  the  electrical  failure 
protection  to  two-fail-operational.  This  increased  protection  could  be  obtained  for 
a  relatively  small  change  in  electrical  complexity.  A  triple-redundant  implementation 
was  necessary  for  a  single-fail-operational  system.  By  addition  of  only  one  more 
branch,  another  entire  level  of  failure  protection  could  be  obtained. 

Figure  3  is  a  schematic  of  the  F-16  pitch  axis,  which  shows  the  system  redundancy 
levels.  The  pitch  axis  is  the  most  critical  on  the  F-16  because  of  the  longitudinal 
static  instability  of  the  aircraft.  This  figure  shows  two  of  the  most  critical  parts  of 
the  redundancy  management  system  of  the  F-16  FLCS.  The  first  is  the  signal  "selector". 
This  device  selects  a  good  electronic  channel  even  after  two  consecutive  electronic 
branch  failures.  The  evolution  of  the  selector  design  was  a  significant  part  of  the 
development  of  the  F-16  analog  fly-by-wire  FLCS.  The  second  critical  part  of  the  re¬ 
dundancy  management  system  is  the  electrical-to-mechanical  interface  provided  by  the 
servoampl if ier  monitor  system  and  the  self-contained  hydro-mechanical  failure  detection 
and  correction  logic  in  the  ISA. 


FLIGHT  EXPERIENCE 

The  F-16  now  has  accumulated  well  over  250,000  flight  hours  with  eight  different 
Air  Forces.  This  experience  has  provided  the  basis  for  many  "lessons  learned".  The 
first  observation  is  that  the  FLCS  has  done  an  excellent  job  of  protecting  against  the 
typical  sequential  failures  it  was  designed  to  protect  against.  This  observation  is  of 
no  particular  surprise,  since  the  FLCS  was  designed  for  a  safety  probability  of  millions 
of  flight  hours  and,  although  FLCS  flight  experience  is  considerable,  it  is  nowhere  near 
the  predicted  safety  probability. 

Experience  has  shown  that  the  biggest  concerns  relative  to  aircraft  fly-by-wire 
flight  control  systems  are  unforeseen  factors  that  can  defeat  redundancy.  Examples  of 
these  factors  are 

o  Pilot  Interface 
o  Ground  Maintenance 
o  Structural  Resonance 
o  Other  System  Failures 
o  Indirect  Electrical  Hazards 
o  Environmental  Conditions. 

Protection  against  factors  that  can  defeat  redundancy  is  two-fold.  First,  experience 
from  previous  flight  control  system  designs  is  woven  into  the  basic  design  of  a  new 
system  from  the  beginning.  However,  if  the  new  system  is  an  advancement  of  technology, 
there  will  probably  be  unforeseen  factors.  Therefore,  the  FLCS  design  and  operations 
team  must  be  very  responsive  to  indications  of  any  problem  during  flight  operations. 

Usually  a  potential  problem  will  give  a  warning  if  the  proper  personnel  are  aware 
of  the  symptoms.  An  experienced  failure  analysis  team  is  necessary  to  recognize  poten¬ 
tial  problems.  Many  potential  problems  will  not  manifest  themselves  until  the  aircraft 
moves  out  of  the  development  phase  into  a  general  operational  environment.  In  summary, 
there  is  no  substitute  for  flight  experience  in  operational  usage. 

On  the  F-16,  the  experience  gained  in  flight  testing  and  operational  usage  has  been 
used  to  improve  the  FLCS.  Illustrative  examples  based  on  experience  are  as  follows: 

o  Maintenance  Memory 
o  Structural  Resonance 
o  Ground  Maintenance 
o  Pilot  Command. 
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Maintenance  Memory 

Early  in  the  F-16  program  it  became  apparent  that  additional  time-sequenced  data 
would  be  a  big  aid  in  isolating  and  resolving  system  problems.  Pilot  statements  of  sys¬ 
tem  problems  were  not  always  sufficient  to  identify  the  problem  source.  The  pilot  is 
not  always  aware  of  failure  symptom  sequence  or  is  not  able  to  remember  the  sequence 
accurately  after  flight.  This  problem  was  aggravated  by  the  fact  that  some  failures 
give  multiple  indications  that  cannot  all  be  observed  in  a  short  time  interval.  In 
some  cases,  the  pilot  is  not  always  aware  of  any  procedural  errors  he  may  have  made. 

The  early  F-16  had  hardware  failure  annunciators;  however,  these  devices  did  not 
always  provide  adequate  information  to  resolve  the  cause  of  transient  problems  that  no 
longer  existed  after  flight.  The  need  for  better  failure  data  resulted  in  the  develop¬ 
ment  of  a  maintenance  memory  for  the  F-16  Flight  Control  System. 

Figure  4  shows  the  various  components  that  make  up  the  F-16  maintenance  memory 
system.  A  non-volatile  microprocessor-controlled  memory  was  installed  in  both  the  ECA 
and  FLCC.  The  data  stored  in  these  two  memories  were  also  recorded  into  a  non-volatile 
memory  located  on  the  ejection  seat.  The  data  stored  in  these  memories  can  be  retrieved 
from  the  ECA,  FLCC,  or  seat  data  recorder  by  ground  test  equipment.  Table  1  describes 
the  features  of  the  FLCS  maintenance  memory. 

A  new  piece  of  ground  equipment  was  developed  to  allow  maintenance  personnel  to 
interrogate  the  memory  direcly  without  removing  any  FLCS  equipment.  This  FLCS  "fault 
finder"  can  be  plugged  into  the  flight  control  panel  in  the  cockpit. 

The  F-16  FLCS  maintenance  memory  is  not  a  "crash  recorder"  but  does  have  many 
features  that  make  it  very  valuable.  The  seat  unit  was  designed  to  survive  the  ground 
impact  of  an  ejected  seat.  It  has  also  been  shown  capable  of  surviving  most  ground  im¬ 
pacts  even  if  it  is  still  installed  in  the  aircraft.  However,  the  seat  unit  has  very 
limited  protection  against  fire.  In  many  cases  data  can  also  be  retrieved  directly 
from  the  FLCC  and  ECA  memory  chips,  even  when  the  units  are  almost  completely  destroyed. 


Structural  Resonance 


When  firing  the  20mm  gun  on  early  production  aircraft,  yaw  failure  indications  and 
yaw  transients  occurred  occasionally.  These  symptoms  were  very  perplexing  since  no 
problems  had  been  experienced  during  the  FSD  program,  all  FLCS  units  were  qualified  to 
the  gun-firing  environment,  and  gun-firing  frequencies  are  well  above  the  response  capa¬ 
bility  of  the  F-16  analog  flight  control  system. 

The  cause  of  the  problem  was  finally  traced  to  a  local  resonance  of  the  structure 
that  held  the  lateral  accelerometer,  which  is  positioned  in  the  F-16  as  shown  in  Figure 
5.  The  failure  scenario  was  as  follows: 

o  Gunfiring  introduces  high-energy  oscillations  into  the  airframe  at  100  Hz. 

o  Local  resonance  of  lateral-accelerometer  mounting  structure  occurs  at  300  Hz. 

o  Lateral  acceleration  due  to  the  third  harmonic  of  gun-fire  frequency  is  ampli¬ 
fied  several  orders  of  magnitude  by  local  structural  resonance. 

o  Frequency  and  acceleration  levels  act  on  the  mechanical  components  of  the  torque- 
balance  accelerometer  in  a  non-linear  manner  to  produce  a  DC  off-set. 

o  The  erroneous  lateral  acceleration  signal  causes  the  Stability  Augmentation 
System  (SAS)  to  command  rudder  motion. 

o  Rudder  motion  causes  a  yaw  transient. 

o  Channel  differences  produce  failure  indications. 

One  of  the  first  questions  that  comes  to  mind  is  why  this  problem  was  not  seen 
during  FSD  testing.  Further  investigation  showed  that  a  small  flight  test  instrument 
was  installed  on  the  same  mounting  structure  as  the  accelerometer  unit.  This  added 
equipment  changed  the  natural  frequency  of  local  structure  so  that  resonance  did  not 
occur  with  harmonics  of  the  gun-fire  oscillations. 

The  problem  was  resolved  by  re-analysis  and  test  of  the  mounting  structure.  An 
isolation  mount  was  then  desired  for  the  accelerometer  package  to  essentially  eliminate 
gunfiring  frequencies  (see  Figure  6). 

The  lessons  learned  from  this  experience  were  as  follows : 

o  Detailed  analysis  and  testing  is  required  of  local  structure  near  flight  control 
sensors . 

o  Seemingly  small  equipment  or  mounting  changes  can  have  a  big  effect  near  FLCS 
sensors  and  must  be  carefully  monitored. 
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Ground  Maintenance 

A  typical  symptom  of  a  problem  in  the  ground  maintenance  category  would  be  aircraft 
pitch  transients  while  flying  in  icing  conditions.  Problems  with  icing  were  not  con¬ 
sidered  highly  probable  because  all  five  FLCS  air  data  probes  have  separate  anti-ice 
heater  power  circuits  from  the  essential  aircraft  bus;  before  every  flight  the  pilot 
turns  on  probe  heat  or,  if  he  forgets,  it  is  automatically  turned  on  at  takeoff. 

The  cause  of  this  problem  was  isolated  to  the  maintenance  personnel  having  left  all 
five  probe  heater  circuit  breakers  open.  The  failure  scenario  was  as  follows: 

o  Ground  maintenance  man  leaves  all  probe  heat  circuit  breakers  open. 

o  Probes  ice  up  in  flight. 

o  Ice  causes  random  motion  to  occur  on  at  least  two  angle-of-attack  probes. 

o  Angle-of-attack  feedback  to  FLCS  produces  pitch  transient. 

Several  questions  come  to  mind  after  studying  this  problem  scenario.  First,  one 
wonders  why  a  maintenance  man  would  open  all  five  probe  heat  breakers.  The  reason  is 
that  probe  heat  is  a  burn  hazard  to  maintenance  personnel  when  performing  tasks  that 
require  aircraft  weight-on-wheels  logic  to  be  bypassed  (e.g.,  gear  tests,  FLCS  tests, 
etc).  Also,  energizing  probe  heat  on  the  ground  can  reduce  probe  heater  life  and  can 
cause  significant  damage  if  ground  protective  covers  are  not  removed. 

The  second  question  deals  with  the  reasons  that  ground  procedures  did  not  catch 
this  problem.  All  ground  maintenance  and  pre-flight  procedures  call  for  verification 
that  probe-heat  breakers  are  energized.  Apparently,  the  frequency  with  which  these 
breakers  are  opened  coupled  with  unknown  situations  result  in  these  breakers  being  over¬ 
looked.  The  problem  has  been  resolved  by  multiple  pre-flight  verification  of  probe 
heat,  and  a  proposal  has  been  submitted  for  probe  heat  to  be  included  in  the  built-in 
test  conducted  by  the  pilot. 

The  important  lessons  learned  from  this  experience  are  that 

o  Where  a  single  maintenance  man  must  routinely  disable  critical  redundant  cir¬ 
cuits,  the  chances  are  high  that  at  some  time  the  circuits  will  be  left  disabled 
for  flight,  thus  defeating  redundancy. 

o  Verification  of  probe  heat  should  be  included  in  future  FLCS  monitor  and  self¬ 
test  designs. 


Pilot  Command 

A  typical  symptom  of  an  unforeseen  factor  in  the  pilot  command  category  wouid  be 
departure  of  the  aircraft  from  controlled  flight  while  avoiding  defensive  aircraft 
during  a  ground  attack  mission.  The  F-16  is  essentially  "eyes  out  of  the  cockpi*-"  for 
air-to-air  combat,  with  the  flight  control  system  automatically  allowing  the  pilot  to 
obtain  maximum  acceleration  and  AOA  without  watching  his  instruments.  However,  in  early 
F-16  versions,  the  pilot  had  to  observe  certain  roll-rate,  angle-of-attack,  and  accelera¬ 
tion  restrictions  for  air-to-ground  loadings. 

The  cause  of  this  type  of  problem  was  rooted  in  the  fact  that  pilots  had  become 
extremely  comfortable  with  the  ability  of  the  flight  control  system  to  protect  them 
from  over-command  in  air-to-air  maneuvering  so  that,  when  carrying  out  air-to-ground 
missions,  they  forgot  and  exceeded  roll-rate-command  limitations. 

Discussions  revolving  around  this  typical  symptom  of  pilot  over-command  always 
brought  out  the  statement  that  a  qualified  pilot  should  always  be  aware  of  his  situa¬ 
tion  and  observe  all  limitations,  as  is  required  on  conventional  aircraft.  However, 
further  investigation  revealed  that  the  ability  in  air  combat  to  maneuver  with  "reck¬ 
less  abondon",  with  eyes  out  of  the  cockpit,  has  been  one  of  the  most  outstanding 
features  of  the  F-16.  Pilots  have  come  to  depend  on  the  ability  of  the  FLCS  to  maxi¬ 
mize  his  commands,  thus  allowing  him  to  concentrate  on  other  aspects  of  his  mission. 
Because  of  the  success  of  this  concept  in  air  combat,  the  pilot  has  difficulty  re-adjust¬ 
ing  to  conventional  limitation  for  air-to-ground  loadings. 

Resolution  of  this  problem  was  obtained  by  implementing  a  system  to  maximize  pilot 
commands  for  air-to-ground  loadings.  A  pilot-selectable  switch  allows  the  pilot  to 
switch  between  air-to-air  and  air-to-ground  maximizer  configurations.  A  caution  light 
tells  the  pilot  if  he  is  in  the  wrong  switch  position  for  the  existing  aircraft  loading. 

The  primary  lesson  learned  from  this  experience  is  that  if  an  FLCS  feature  is  so 
successful  that  pilot  reliance  upon  it  becomes  "second  nature",  he  may  not  always  re¬ 
vert  to  conventional  operation  in  other  modes. 
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The  lessons  learned  from  flight  experience  discussed  in  this  paper  are  summarized 
as  follows: 

o  The  biggest  concerns  will  occur  as  a  result  of  unexpected  conditions, 
o  Operational  flight  is  the  only  way  some  of  these  problems  will  be  identified 
and  rectified. 

o  A  modern  fly-by-wire  FLCS  needs  some  type  of  maintenance  memory  to  record  time- 
sequenced  data  for  identification  and  resolution  of  problems, 
o  Local  structure  can  cause  problems  and  therefore  requires  special  attention, 
o  Electrical  power  deserves  more  attention  than  industry  has  given  it  in  the  past, 
o  During  maintenance,  critical  FLCS  circuits  must  routinely  be  disabled.  There¬ 
fore,  more  than  the  "normal"  safeguards  must  be  observed  to  prevent  flight  un¬ 
less  the  circuit  is  enabled  again. 

o  If  pilot  reliance  on  an  FLCS  feature  becomes  "second  nature",  the  cases  where 
he  must  go  back  to  conventional  operation  should  be  minimized. 


CONCLUSIONS 

The  technical  community  spends  a  tremendous  amount  of  effort  on  the  theoretical 
analysis  of  flight-critical  systems  such  as  the  FLCS.  Detailed  theoretical  probability 
calculations  are  performed  to  determine  the  best  system  architectural  approach  to  solve 
FLCS  failure-protection  problems.  Usually  these  determinations  are  based  on  calcula¬ 
tions  showing  millions  of  flight  hours  before  system  failure.  However,  experience  has 
shown  that  the  real  concern  is  learning  how  to  minimize  the  effect  of  unknown  problems. 
The  relationship  between  theoretical  safety  probabilities  and  susceptibility  to  unknown 
problems  is  not  clear. 
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m Pitch  Axis  Also  Indludes  St  lector  on  Inttgrstor  Outputs 

FIGURE  3  HOW  ELECTRONIC  REDUNDANCY  WORKS 
(PITCH  AXIS  SHOWN) 


FIGURE  4  THE  F-16  FLIGHT  CONTROL  SYSTEM  MAINTENANCE  MEMORY  SYSTEM 


TABLE  1  MAINTENANCE  MEMORY  FEATURES 


•  RECORDED  FUNCTIONS 

*  TIME  AFTER  TAKE-OFF 

*  ALL  REDUNDANCY  MANAGEMENT  MONITOR  STATES 

*  CRITICAL  FLCS  SWITCH  POSITIONS 

*  FLCS BATTERY  DISCHARGE 

*  ANGLE  OF  ATTACK 

*  AIRSPEED 

*  ALTITUDE 

*  SELF-TEST  SURFACE  POSITION  MSCRETES 

*  FLCS  CAUTION  AND  WARNING  LIGHTS 


•  RECORDING  TIMES 

*  EVERY  64  SECONDS 

*  EVERY  TIME  A  REDUNDANCY  MANAGEMENT  STATE  CHANGES.  FLCS 
LIGHT  ILLUMINATES,  OR  CRITICAL  SWITCH  IS  THROWN 


•  SIZE 

*  APPROXIMATELY  SO  SQ.  INCHES  OF  BOARD  AREA  IN  ECA  AND  FLCC 

*  4"  x  5"  x  2"  RECORDER  MOUNTED  ON  EJECTION  SEAT 


•  MEMORY  TECHNOLOGY 

«-  N-MOS  EA  ROMS  (4  IK  By  4) 


FIGURE  5  F-16  ACCELEROMETER  ASSEMBLY 


BONDING 


FIGURE  6  ACCELEROMETER  ISOLATION  MOUNT 
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AVIONS  MARCEL  DA5SAULT  -  BREGUET  AVIATION  (AMD-BA) 

78,  Quai  Carnot  -  92214  ST-CLOUD  -  TRANCE 


RESUME 


Le  MIRAGE  2000  est  rdalisd  pour  presenter  la  meilleure  efficacitd  en  combat.  II  utilise  dans 
ce  but  des  CDVE  dvoludes  qui  permettent  une  application  raisonnable  du  Contrfile  Automatique  Gdndralisd  de  I'avion. 
Une  recherche  poussde  de  la  sGretd  du  fonctionnement  du  systfeme  de  pilotage  nous  conduit  &  un  object'd  de  sdcuritd 
nettement  supdrieur  S  celui  observe  sur  les  avions  antdrieurs.  L’ensemble  de  nos  objectifs  de  performances  et  de 
sdcuritd  ont  fait  l'objet  de  validations  thdoriques  et  pratiques  en  laboratoires  et  en  vol,  pour  justifier  une  utilisation 
opdrationnelle  des  CDVE. 

INTRODUCTION 

Le  MIRAGE  2000  est  le  premier  avion  Europden,  et  le  seul  aujourcThui,  qui  utilise  opdrationnel- 
lement  des  COMMANDES  DE  VOL  ELECTRIQUES  (C.D.V.E.)  sans  timonerie  mdcanique.  Les  CDVE  de  I'avion  sont 
issues  de  I'expdrience  acquise  par  les  dquipes  specialises  des  AVIONS  MARCEL  DASSAULT  -  BREGUET  AVIATION 
depuis  plus  de  trente  ans  sur  toutes  les  commandes  de  vol  de  tous  les  avions  de  la  famille  MIRAGE  ;  elles  associent 
I'efficacitd  opdrationnelle  et  la  security  en  vol.  La  security  ddcoule  de  la  suppression  des  consignes  et  des  restrictions 
d'emploi  £  observer  par  le  pilote,  en  raison  de  I'architecture  redondante  du  systdme  des  limitations  automatiques 
sOres  et  de  la  gestion  intdgrde  des  pannes. 


OBJECTIFS  DE  CONCEPTION 

Nous  avons  ddcidd  lors  de  la  conception  initiale  du  MIRAGE  2000  tfutiliser  pleinement  les 
avantages  du  traitement  dlectronique  dans  les  commandes  de  vol,  en  bdndficiant  des  enseignements  des  travaux  rdalisds 
pour  I'ACT  (1975)  et  de  I'expdrience  des  commandes  de  vol  &  transmissions  dlectriques  du  MIRAGE  III  (1955)  et  du 
MIRAGE  FI  (1968). 

-  sur  le  plan  fonctionnel,  les  CDVE  du  MIRAGE  2000  sont  ddfinies  pour  rdpondre  d  trois  objectifs  principaux, 
qui  ont  tous  pour  but  d'accrottre  I’efficacitd  de  I'avion  : 

.  Permettre  le  pilotage  de  I'avion  instable,  ce  qui  est  bdndfique  sur  le  plan  des  performances  (vitesse  tfapproche, 
marge  de  manoeuvre,  ...)  et  minimise  les  contraintes  de  chargement  de  I'avion  ; 

.  Pratiquer  opdrationnellement  les  hauted  incidences  subsoniques,  dventuellement  jusqu'd  vitesse  nulle,  ce  qui 
est  determinant  en  combat  ; 

.  supprimer  les  limitations  en  fonctionnement  normal. 

-  sur  le  plan  de  la  sdcuritd,  les  CDVE  sont  rdalisdes  pour  satisfaire  deux  objectifs  majeurs  : 

.  Qbtenir  un  niveau  de  sdcuritd  global  supdrieur  ou  dgal  &  celui  des  avions  precedents  ; 

.  Obtenir  une  bonne  protection  centre  les  risques  de  guerre  (vulndrabilitd  aux  armes,  £  ITEM...) 

Le  niveau  global  de  sdcuritd  que  nous  avons  ddfini  pour  les  CDVE  et  ses  systdmes  associds 
(hydraulique,  dlectricitd  et  andmomdtrie)  rdsulte  efune  dtude  AMD-BA  conduite  d  partir  de  recueils  cfincidents  majeurs 
et  cfaccidents  cfavions  de  combat  dans  le  monde  entier.  La  statistique  dtablie  repose  sur  plus  de  10'  heures  de  vol, 
effectudes  en  plus  de  10  ans  par  plus  de  5000  avions  modernes  F rangais  et  Etrangers  ;  elle  conduit  4  un  taux  de  pannes 
catastrophiques  des  commandes  de  vol  qui  est  infdrieur  d  la  rdalitd  par  suite  de  I’imprdcision  de  certaines  enqudtes 
(pertes  de  contrdle  non  expliqudes,  avions  non  rdcupdrds...). 

Ce  taux  ,  hors  fait  de  guerre,  est  compris  entre  3,5  x  10  ^7 h  (28OD00  h)  et  5,6  x  10  ^/h 
(180JD0  h).  En  rdalitd,  nous  pensons  que  ce  taux  est  plus  fort  ;  cfailleurs  les  exigences  ddfinies  en  ce  domaine  pour 
les  avions  Amdricains  sont  fixdes  d  10"^/h  (100.000  h)  dans  la  norme  MIL  9490D.  Dans  le  cas  du  MIRAGE  2000,  qui 
bdndficie  de  toute  notre  expdrience  et  tfun  systdme  complet  rdalisd  par  AMD-BA,  nous  avons  retenu  un  objectif 
de  sdcuritd  ambitieux  puisque  efun  ordre  de  grandeur  supdrieur. 

TlcCDVE  MIRAGE  2000  <  10"6/h 


AUGMENTATION  DE  LA  SECURITE  GENERALE  PAR  LES  CDVE 

En  fait  les  pannes  catastrophiques  de  commandes  de  vol  ne  reprdsentent  qu'une  part  trds  faible 
dans  les  causes  de  pertes  cfavion.  Les  accidents  impulables  d  des  fautes  de  pilotage  sont  beaucoup  plus  nombreux  (5 
d  10  fois).  Les  commandes  de  vol  dlectriques  du  Mirage  2000,  par  I'amdlioration  des  qualitds  de  vol  qu'elles  apportent 
d*une  part  et  par  les  protections  automatiques  qu'elles  assurent  cfautre  part,  doivent  augmenter  trds  sensiblement 
la  sdcuritd  de  I'avion  : 

-  les  qualitds  de  vol  procurdes  par  les  commandes  de  vol  sont  telles  que  le  pilote  peut  sans  risque  i nettre  ses 
commandes  en  butde  en  tous  les  points  du  domaine  de  vol.  II  peut  dgalement,  psr  des  manoeuvres  dsns  le  plan 
vertical,  amener  I'avion  au  voisinage  de  la  vitesse  nulle,  la  rdcupdration  s'effectuant  sans  difficultd.  La  prdcision 
des  commandes  de  vol  repousse  les  risques  de  pompsge  pilotd  (PI0)  et  facilito  les  opdrations  ddlicates  telles 
que  le  ravitaillement  en  vol. 
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-  Les  protectinns  automatiques  limitent  le  facteur  de  charge,  les  braquages  de  gouvernes  et  les  vitesses  de  roulis 
afin  cfempdcher  le  pilote  de  ctepasser  les  charges  structurales  limites.  Elies  empfechent  ygalement  le  pilote 
cfatteindre  des  incidences  qui  pourraient  poser  des  probifemes  de  contrble  tant  que  la  vitesse  est  suffisante  pour 
cr^er  effectivement  ces  problfemes. 

Enfin  le  pilote  a  la  possibility,  sur  la  commande  de  profondeur,  d'ycraser  une  but#e  yiastique, 
ce  qui  permet  de  d^passer  la  charge  limite  sans  atteindre  la  charge  de  rupture,  afin  cfdviter  le  sol  par  exemple. 

DEFINITION  DES  CDVE 

Les  CDVE  du  Mirage  2000  sont  d^finies,  r^alis^es  et  validdes  par  les  AMD-BA,  eomme  pour 
tous  les  avions  de  la  famille  MIRAGE.  Ceci  permet  cfassurer  une  unity  de  conception  et  une  intygration  poussye  des 
fonctions  mycaniques,  hydrauliques  et  yiectroniques  dans  I'avion. 

Les  CDVE  du  MIRAGE  2000  sont  caractyrisyes  par  les  traits  essertiels  suivants  : 

•  Utilisation  de  niveaux  de  redondances  moduiys  suivant  1'axe  de  pilotage,  les  fonctions  ryalisyes,  les  risques 
de  mode  commun  (foudre,  1EM,  impacts...) ; 

.  Reconfiguration  fonctionnelle  suivant  I'ytat  de  dygradation  des  capteurs  ; 

.  Adoption  cfune  signalisation  globale,  qui  supprime  les  interprytations  ; 

.  Utilisation  cfun  dispositif  automatique  de  gestion  des  dyfaillances  du  systfeme  ; 

.  Utilisation  cfune  commande  yiectrique  cfultime  secours. 

-  Sur  le  plan  de  la  conception  qynyrale,  le  systfeme  CDVE  est  prysenty  figure  I  ou  apparaissent  : 

.  deux  circuits  hydrauliques  ; 

.  quatre  alimentations  yiectriques  ; 

.  les  capteurs  pilote  et  inertiels  £  quatre  voies  en  tangage  ; 

.  les  capteurs  anymo-baromytriques  triples  liys  &  un  ealculateur  S  trois  processeurs  pour  isolement  des 
foudroiements  ; 

.  les  Racks  des  chalnes  CDVE  ;  quatre  chatnes  en  tangage  et  trois  chatnes  en  transversal. 

.  les  capteurs  et  le  ealculateur  spycifique  de  la  commande  (fultirne  secours  ; 

.  les  servocommandes  yiectro-hydrauliques  &  double  corps  et  entrye  yiectrique  de  secours  indypendante  ; 

.  les  bees. 

-  Les  qynyrations  et  distributions  hydrauliques  sont  basyes  sur  ['utilisation  de  deux  circuits  distincts  &  280  bars 
(4000  PSD.  Une  pompe  est  entraTnye  par  ie  ryacteur,  la  seconde  par  I'intermydiaire  du  relais  <f accessoires  (figure  - 
2).  Une  yiectro-pompe  primaire  est  branchye  en  paraliyie  sur  le  circuit  2  ;  elle  est  alimentye  par  le  ryseau  28  V 

de  ['avion. 

L'expyrience  des  circuits  hydrauliques  de  nos  avions  montre  que  la  perte  des  deux  circuits  dans 
un  iriSme  vol  n'a  jamais  yty  rencontrye,  et  que  la  perte  cfun  circuit  a  un  taux  voisin  de  5  x  10'Uh. 

-  Les  gyndrations  et  distributions  yiectriques  sont  prysentyes  figure  J.  Elies  sont  congues  pour  alimenter  deux 
chaines  de  CDVE  en  toutes  circonstances,  y  compris  I'extinction  ryacteur  &  trfes  faible  vitesse  (en-dessous  de 
100  Kt). 

.  Une  gynyration  est  ryalisye  4  partir  de  chaque  circuit  hydraulique.  Les  alimentations  E  j  et  E2  correspon- 
dantes  sont  exclusivement  ryservyes  aux  chatnes  1  et  2  des  CDVE. 

.  Une  gynyration  Ej  est  liye  aux  gynyrateurs  principaux  de  I'avion.  Elle  alimente  la  chatne  J  des  CDVE, 
le  ealculateur  triple  tiy  aux  capteurs  anymo-baromytriques  et  le  ealculateur  de  mycanismes  des  bees. 

.  Une  gynyration  E^  ryalisye  par  la  batterie  de  I'avion.  La  chatne  4  des  CDVE  est  alimentye  par  un  conver- 
tisseur  extyrieur  (DC/DC)  alors  que  la  chatne  de  secours  dispose  cfun  convertisseur  autonome. 

Selon  nos  ytudes,  et  nos  essais,  nous  estimons  extrSmement  improbable  cfavoir  plus  de  deux  alimentations 
yiectriques  en  panne,  durant  un  vol.  En  outre,  notre  expyrience  montre  qu'un  foudroiement  n'a  jamais 
entratny  de  destruction  de  batterie  en  bon  ytat. 

-  L'architecture  des  CDVE  rysulte  de  la  formule  ayrodynamique  de  I'avion,  du  nombre  des  gouvernes  -  quatre  yievons 
en  tangage  et  en  roulis,  un  drapeau,  les  bees  -  et  des  effets  transitoires  admissibles  lors  de  pannes. 

Aprfcs  une  ytude  et  des  essais  dytailiys,  nous  avons  retenu  deux  dispositions  de  base  et  une 
redondance  moduiye  : 

.  Les  calculateurs  de  CDVE  sont  au  nombre  de  cinq  : 

»  Deux  Racks  analogiques  pour  les  quatre  yievons  et  pour  le  gouvernail  de  direction. 

«  Un  Rack,  numyrique,  pour  les  gains  automatiques. 

«  Un  ealculateur  analogique  dual  pour  les  bees. 

»  Un  ealculateur  analogique  pour  la  commande  de  secours. 

Cette  disposition  assure  un  niveau  eompiymentaire  de  redondance  vis  d  vis  des  pannes  de  mode 
commun  (impact,  feu,  dybranchement  de  ealculateur  ...). 

.  Les  chalnes  de  CDVE  normales  sont  trongonnyes  par  des  voteurs  yiectroniques  (figure  4  dans  le  cas  de 
la  profondeur).  Ceci  permet  de  multiplier  les  toiyrances  aux  pannes  et  de  limiter  leurs  effets  tout  en 
ygalisant  les  toiyrances  de  ryalisation.  On  remarquera  le  doublement  des  voteurs  cfordres  pour  tenir  compte 
de  la  panne  interne  des  voteurs. 
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Les  chatnes  quadruples  sont  utilises  en  prafondeur  et  en  gauehissement  ;  elles  sont  bees  aux  quatre  serxocommandes 
lies  elevoos  et  permettent  de  supporter  toutes  secondes  pannes  sans  modifier  les  performances.  La  commande 
de  secours  constitue  une  redondance  supplemental  re  pour  ces  axes  de  pilotage. 

La  solution  retenue  peut  etre  symbolisee  par  le  diagramme  suivant  : 

PILOTE  consolidation  ELEVONS 


Les  chafnes  triples  ont  ete  retenues  quand  I'avion  peut  §tre  pilote  en  mode  degrade  apr£s  la  perte  de  certaines 
fonctions,  ou  lorsque  Ton  sait  creer  une  fonction  secours,  mfme  moins  performante,  dans  cfautres  calculateurs. 
Ce  sont  : 

.  I'eiaboration  des  ordres  en  direction,  compietee  par  la  commande  de  secours,  que  nous  symbolisons  ainsi  : 


PILOTE  consolidation  DRAPEAU 


.  les  detections  gyrometriques  et  acceierometriques  transversales  (p,  r,  Jy) 

.  I'eiaboration  des  gains  automatiques  et  de  I'incidence  pour  limitations  automatiques. 
Ces  fonctions  sont  presentees  plus  loin. 


Les  chatnes  doubles  duales  monitorEes,  sont  retenues  en  aval  des  Elaborations  cfordres,  pour  les  cinq  servo- 
commandes  de  qouvernes.  Ce  type  de  redondance  est  symbolisE  de  la  maniEre  suivante  : 


SfCUBIlE  OOUDLE  01*1  f  MONUOHEE 


DOUBLE  :  car  il  existe  un  servo-moteur  NORMAL  et  un  servo-moteur  SECOURS 

DIJALE  :  car  chaque  servo-valve  comporte  deux  moteur  couples.  Un  moteur  couple  est  ME  E  une  voie,  le  second 
E  I'autre,  dans  une  mfime  chaTne  (N-N1,  S-S') 

MONITOREE  :  car  chaque  chalne  assure  sa  propre  surveillance. 

Remarque  :  La  confiquration  double  duale  monitorEe  des  servoeommandes  est  rendue  possible  par  les  considE- 
rations  suivantes  : 

*  doublement  des  ordres  de  braquaqe  de  chaque  chatne  COVE 

*  utilisation  des  deux  circuits  hydrauliques  par  servoeommandes 

*  contrflle  possible  de  l'avion  avec  deux  Elevens,  les  autres  Etant  braquEs  prfes  du  neutre  (fai»). 

La  rEpartition  des  chafnes  COVE  sur  les  qouvernes  est  prEsentEe  figure  5  ;  elle  se  dEduit  des  redondances  prEsentEes 
en  prEalable.  Cette  distribution  permet  de  concilier  sEcuritE  et  invulnErabilitE,  en  crEant  un  niveau  de  redondance 
complEmentaire  dfl  E  la  multiplicitE  des  gouvernes  utilisEes  en  tanqage  et  en  roulis  (4  Elevons). 

.  ELEVONS  EXTERNES  (et  direction  normale)  contrdlEs  par  les  chatnes  2  et  3,  contenues  dans  un  seul  Rack. 

.  ELEVONS  INTERNES  (et  direction  secours)  contrftlEs  par  les  chatnes  1  et  4,  contenues  dans  un  second  Rack. 

.  L'ensemble  des  gouvernes  pilotEes  en  modes  secours  (braquaqe  cfEquilibre,  ou  pilotage  de  toutes  les  gouvernes). 

Ainsi,  nous  pouvons  obtenir  les  modes  de  pilotage  suivants  : 

*  Pilotage  bouclE  de  toutes  les  gouvernes  en  I'absence  de  panne  j 

*  Pilotage  bouclE  de  toutes  les  gouvernes  en  prEsence  tfune  panne  de  chatne  :  il  y  a  perte  (June  redondance 
sur  3  gouvernes  au  maximum  ; 

*  Pilotage  de  deux  Elevons  (et  Eventuellement,  direction)  en  mode  bouclE,  et  positionnement  de  deux  Elevons 
E  un  braquaqe  dEterminE. 

*  Pilotage  de  toutes  les  gouvernes  en  mode  secours,  par  la  commande  Electrique  de  secours. 

Remarque  : 

ON  NOTERA  DUE  L'ENSEMBLE  DES  GOUVERNES  DEMEURE  CONTROLABLE  APRES  DESTRUCTION  OU 
DEBRANCHEMENT  DE  L'UN  QUELCONQUE  DES  CALCULATEURS  DE  CHAINES  CDVE. 


Les  gains  automatiques  sont  ElaborEs  dans  un  calculateur  unique,  alimentE  par  le  rEseau  avion  (Ej).  Cette  dispo¬ 
sition  permet  de  limiter  les  risques  de  destructions  qui  rEsultent  des  foudroiements  trEs  sEvEres  (dl/dt»0?  a/s), 
en  raison  des  liaisons  que  possEde  le  calculateur  avec  les  sondes  anEmomEtriques. 

Les  gains  automatiques  ont  une  grande  importance  pour  pondErer  les  ordres  de  braquages  des 
qouvernes,  suivant  le  point  de  vol  ;  leur  Elaboration  doit  Etre  sOre.  En  outre,  les  pondErations  rendues  possibles 
par  le  calcul  fin  des  gains  automatiques  sont  essentielles  pour  Elsborer  les  fonctions  de  limitations  automatiques 
retenues  pour  dElivrer  le  pilote  de  tftches  absorbantes  et  dElicates.  Ces  limitations  existent  pour  assigner  l'avion 
E  une  incidence  limite  et  E  un  facteur  de  charge  maximal. 
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Nous  avons  done  retenu  pour  les  calculs  des  gains  fonctions  du  Mach  et  de  ['altitude,  trois 
processeurs  numeriques  specialises,  de  notre  conception,  qui  utilisent  en  synchronisme  un  logiciel  unique.  La 
validation  complete  de  ce  logiciel  a  ete  indispensable  pour  demontrer  que  nos  objectifs  de  securite  sont  atteints. 
Cette  structure  triple  processeurs,  associee  &  un  dispositif  specifique  de  gestion  et  de  rearmement  des  pannes 
nous  perrnet  : 

.  de  poursuivre  le  calcul  des  gains  apres  panne  simple  ; 

.  d'arreter  le  calcul  des  gains  &  la  seeonde  panne, 

.  de  rearmer  automatiquement  les  premieres  et  secondes  pannes  apr&s  leurs  disparjtions.  Ce  processus  est 
fondamental  en  combat. 

Enfin,  le  ptlote  dispose  efun  s^lecteur  de  gains  programmes  dans  chaque  chaTne  CDVE  si  le 
calculateur  est  d^faillant. 

La  limitation  automatique  de  I'incidence  est  tr&s  eiaboree  sur  MIRAGE  2000.  Son  efficacite  a  £te  demontree 
lors  des  essais  en  vol  menes  jusqu’a  vitesse  nulle.  Cette  limitation  est  r£alis£e  dans  les  chatnes  CDVE  en  fonction 
efune  mesure  consolidee  de  la  valeur  d'incidence  r^alis^e  dans  le  calculateur  des  gains  automatiques. 

Elle  r^sulte  : 

.  de  la  mesure  cfincidence  droite, 

.  de  la  mesure  cfincidence  gauche, 

.  de  la  mesure  efune  jncidence-pression. 

Pour  des  raisons  analogues  £  celles  expos^es  pour  les  gains  automatiques  nous  avons  isoie  ces 
mesures  susceptibles  de  foudroiements  directs  ;  de  plus  nous  avons  retenu  les  mftmes  dispositions  de  reconfigu¬ 
rations  du  syst^me  sur  pannes  : 

.  r£armements  automatiques  des  premieres  et  deuxifemes  pannes, 

.  commutation  du  limiteur  automatique  sur  un  dispositif  de  secours,  d6nomm£  "CORRECTEUR",  qui  est 
base  sur  la  mesure  du  facteur  de  charge  dans  les  4  chatnes. 

-  La  limitation  automatique  du  facteur  de  charge  est  assume  par  la  conjunction  de  trois  facteurs  et  confirmee 
par  les  essais  statiques  structuraux  : 

.  Utilisation  des  gains  automatiques, 

.  Utilisation  de  {'information  de  presence  des  charges  externes  dans  le  schema  fonctionnel  (schema), 

.  Utilisation  de  lois  cfefforts  dissuasives  au-del£  de  certains  seuils  mais  qui  assurent  des  manoeuvres  de 
tress e  (schema). 
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Les  signal isat ions  au  pilote  presentent  un  caract^re  global,  que  nous  avons  defini  pour  supprimer  tout  risque 
efinterpretation  sur  retat  reel  des  degradations  du  systfcme.  Cette  disposition  nous  paratt  fondamentale  pour 
accroftre  la  security  car  : 

.  la  gestion  du  systfcme  de  signalisation  est  simple,  done  a  priori  fiable 
.  les  risques  de  fausse  interpretation  sont  reduits, 

.  1'analyse  des  defaillances  que  nous  avons  effectuee  perrnet  de  justifier  les  risques  de  degradations  successes 
avec  precision. 

Les  8  voyants  de  pannes  directement  lies  aux  CDVE  sont  regroupes  en  banquette  droite,  et 
repetes  par  un  voyant  general  de  pannes  situe  trfcs  visiblement  devant  le  pilote.  Les  voyants  Rouge  (qui  indiquent 
une  consigne  imperative)  sont  doubles  efune  alarme  sonore.  Le  pilote  dispose  efune  commande  <Je  rearmement 
des  securites  qui  peut  dans  curtains  cas  reactiver  toutes  les  voies  du  systftme. 


Les  tests  automatiques  embarqu6s  sont  £labor£s  dans  le  calculateur  num^rique  branch^  sur  le  rdseau  de  i'avion. 

11  permet  cfex^cuter  des  sequences  de  contrOles  internes  des  £quipements  qui  sont  tr6s  profondes. 

Deux  sortes  de  tests  sont  r§alisables  : 

.  le  test  automatique  des  s£curit£s  et  des  calculateurs  £lectroniques,  realisable  sans  enerqie  ext^rieure, 
comporte  environ  2000  points  de  contrbles.  11  est  executable  pour  verifier  le  systfeme  a  priori,  et  pour 
les  recherches  de  pannes  memorisees  en  vol  ou  au  sol,  ainsi  que  pour  les  depannages. 

.  le  test  automatique  de  1'integrite  generale  du  syst£me  et  des  servocommandes  est  realisable  par  le  pilote 
en  moins  de  10  secondes,  suivant  un  processus  enticement  automatique. 

COMMANDS  DE  SEC  OURS 

L'interet,  ou  la  raison  d'etre  cfune  commande  de  secours  &  des  CDVE  redondantes  est  just  if  ie  par  deux  conside¬ 
rations  essentielles  : 

.  en  combat,  par  les  risques  de  destructions,  d'incendies  qui  resultent  cfimpacts  cfarmes,  cfexplosion  nucieaire 
b  haute  altitude  ...  etc  ; 

.  en  periode  de  paix,  par  les  risques  de  pannes  multiples  du  systfeme  normal,  ou  par  la  defaillance  cfun  POINT 
COMMUN. 

La  definition  de  la  commande  de  secours  a  ete  retenue  la  plus  simple,  pour  obtenir  un  niveau  de  fiabilite  eieve 
et  une  maintenance  simplifiee. 

.  La  commande  de  secours  est  £lectriquement  en  attente,  mais  n'est  pas  active  au  niveau  des  servocommandes, 

.  aprfes  enclenchement,  automatique  ou  manuel,  le  pilote  dispose  cfune  commanoe  de  vol  classique,  de  grande 
quality,  mais  sans  ordres  de  stabilisation  artificielle  ; 

.  les  £I£ments  de  detection,  de  calcul  et  elaboration  des  ordres  de  la  commande  de  secours  sont  s£par£s 
de  leurs  homoiogues  des  chafnes  CDVE  normales  ; 

.  la  commande  de  secours  est  trait^e  pour  supporter  les  effets  de  la  foudre  et  de  1'IEM. 

L'enclenchement  de  la  commande  de  secours  peut  etre  obtenu  de  deux  fagons  : 

.  automatiquement. 

.  Manuellement,  par  le  pilote. 

L'enclenchement  automatique  peut  entralner  deux  modes  distincts  de  fonctionnements,  suivant 
V4tat  de  degradation  du  syst&me  : 

.  mode  imp  ,  utilise  sur  deux  Elevens  en  presence  de  deux  pannes  &  leur  niveau 

.  mode  secours  rencontre  isol£ment  sur  le  gouvernail  de  direction  apr&s  deux  pannes  &  son  niveau,  ou  sur 
les  cinq  gouvernes  principales. 

Ces  enclenchements  ont  pour  effets  : 

.  de  commuter  les  ordres  Slectriques  de  commande  au  niveau  des  servo-moteurs  £lectro-m6caniques  externes 
de  chaque  servocommandes. 

.  de  d£pressuriser  les  servo-moteurs  £lectro-hydrauliques  normaux  et  secours  de  toutes  les  servocommandes. 

JUSTFICATION  DU  SYSTEME 

Les  justifications  des  CDVE  du  MIRAGE  2000  sont  nombreuses  et  complexes.  Elies  sont  groupies 
dans  deux  domaines  compl^mentaires  : 

.  les  justifications  pratiques 
.  les  justifications  th^oriques. 

Les  justifications  pratiques  ont  £t£  entreprises  d£s  l'existence  des  mat^riels  prototypes  et  ont  concern^  : 

.  les  £quipements  ou  eomposants 
.  le  systfeme  complet 
.  I'avion  complet 

■  Les  justifications  des  6quipements  ou  des  eomposants  ont  4t£  faites  en  laboratoires  pour  £prouver  les  mat^riels 
dans  les  conditions  extremes  cfemploi. 

On  notera  en  particulier  les  essais  des  eomposants  £lectroniques  &  des  chocs  de  courants  repr£- 
sentatifs  de  1'IEM  subie  lors  cfune  explosion  nucieaire  &  haute  altitude. 


*  Les  justifications  du  syst£me  complet  ont  les  plus  importantes  et  les  plus  nombreuses  : 

.  Utilisation  (fun  systfrme  COVE  complet,  li#  &  un  sifnulateur  (fetude,  pour  la  mise  au  point,  revaluation 
des  pannes  et  des  eonsiqnes. 

.  Essai  &  la  foudre  rfun  syst£me  CDVE  repr^sentatif  dans  une  cellule  complete  cfavion  : 

*  En  chocs  de  courant 

*  En  chocs  de  tension 

.  Essai  S  1'IEM  rfun  systfcme  CDVE  identique  &  celui  lvalue  &  la  foudre,  dans  une  cellule  complete. 

*  Les  justifications  sur  avion  ont  permis  : 

.  revaluation  des  syst&mes  en  ambiance  perturbee  dans  une  chambre  an£choTde  ou  l'avion  est  simuie  en 
vol. 

.  revaluation  des  pannes  des  COVE  et  des  generations  associees,  l'avion  etant  au  sol,  pour  complement 
devaluation  sur  le  simulateur  rfetudes, 

.  revaluation  des  pannes  des  CDVE  en  vol,  jusqu'd  I'enclenchement  automat ique  (ou  manuel)  des  modes 
degrades  et  secours. 

Les  justifications  theoriques  font  1'objet  cfune  etude  exhaustive  des  pannes  qui  a  dure  deux  ans  environ,  et  entrain# 
I'adoption  de  modifications. 

Nous  avons  etudie  le  systfcme  sous  differents  aspects  : 

.  L'apparition  et  les  effets  des  pannes  successives  pour  une  fonction,  un  axe  de  pilotage  dans  une  chame, 
une  chalne  de  CDVE. 

.  Le  denombrement  et  les  justifications  des  points  communs  £lectriques,  eiectroniques,  m#caniques...  etc 
.  L'efficacit#  et  la  suret#  de  la  siqnalisation  des  pannes  d£di£e  au  pilote  ou  au  personnel  de  maintenance. 

.  l'efficacit#  et  la  suret#  des  tests  automatiques  embarqu#s. 

.  La  determination  des  operations  de  maintenance  et  leur  p^riodicit#. 
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3.  Repartition  ries  Alimentations  l.lectri<|ues 
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SUMMARY 

Measures  applied  to  the  autopilot  of  the  TORNADO  to  ensure  survivability  of  the  aircraft 
after  failures  during  automatic  low  level  flying  are  presented.  Apart  from  redundant 
equipment,  these  measures  include  hardware  and  software  limiters  to  minimize  the  effect 
of  failures  upon  the  aircraft,  hardware  and  software  monitors  to  detect  and  isolate 
failures,  emergency  procedures  to  initiate  recovery  manoeuvres,  as  well  as  efficient 
testing  of  software. 
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1 .  INTRODUCTION 

The  Multi  Role  Combat  Aircraft  TORNADO  is  a  modern  military  aircraft,  which  has 
recently  gone  into  service  with  the  RAF,  GAF,  GNY  and  IAF.  One  of  the  outstanding 
features  of  this  aircraft  is  its  capability  to  fly  at  low  heights  over  land  or  sea, 
i.e.  automatic  terrain  following/automatic  radar  height  hold.  The  autopilot,  as  a  central 
part  of  the  flight  guidance  and  control  system,  is  responsible  for  performance,  integrity 
and  flight  safety  during  automatic  low  level  flying. 


2.  STRUCTURE  OF  THE  TORNADO  FLIGHT  CONTROL  SYSTEM 


Fig.  1  shows  a  block  schematic  of  the  TORNADO  Flight  Control  System. 

The  autopilot  is  a  duplex  redundant  digital  computer.  The  autopilot  receives  sensor 
signals  from  a  number  of  sources:  The  primary  control  signals  for  the  low  level  modes  are 
supplied  from  the  Terrain  Following  Radar  (TFR)  and  the  Radar  Altimeter.  The  signals  for 
guidance  in  the  lateral  plane  are  supplied  from  the  Main  Computer  and  the  Horizontal 
Situation  Indicator  as  well  as  the  Inertial  Navigation  System  (INS)  and  the  Secondary 
Attitude  and  Heading  Reference  System  (SAHRS) .  The  INS  and  SAHRS  are  further  used  for 
attitude  stabilization.  Signals  from  the  Air  Data  Computer  (ADC)  are  used  for  scheduling 
purposes  in  the  low  level  modes  and  for  autothrottle  control. 

The  autopilot  receives  further  signals  via  the  Command  and  Stability  Augmentation 
System  (CSAS) :  Rate  gyro  signals  are  used  for  turn  coordination  and  improvement  of  dynamic 
response.  Pressure  signals  from  the  Triplex  Transducer  Unit  (TTU)  are  used  for  scheduling 
and  monitoring  purposes. 

It  should  be  noted  that  the  signals  from  the  Terrain  Following  Radar,  Main  Computer,  INS, 
SAHRS  and  ADC  are  serial-digital,  while  the  signals  from  the  other  sensors  are  analog  or 
synchro  signals  which  are  converted  into  digital. 

The  autopilot  outputs  to  the  CSAS  are  pitch  and  roll  rate  demands.  These  signals  are  D 
to  A  converted  and  triplicated  in  the  autopilot,  since  the  CSAS  is  a  triplex  analog  system. 
Further  outputs  are  throttle  demand  to  the  autothrottle  actuator,  azimuth  and  elevation 
commands  to  the  Head-Up  Display  and  failure  indications  to  the  Central  Warning  Panel. 


FIO.  1:  BLOCK  SCHEMATIC  OF  TORNADO  FLIOHT  CONTROL  SYSTEM 


3.  SAFETY  REQUIREMENTS 

With  regard  to  flight  safety  during  automatic  low  level  flying,  it  must  be  ensured 
that  no  single  failure  can  lead  to  a  hazardous  situation,  i.e.  the  aircraft  under  auto¬ 
matic  control  must  be  fail-safe.  The  probability  of  multiple  failures  must  be  less  than 
a  specified  small  value. 

4.  MONITORING  FUNCTIONS  AND  AUTOMATIC  EMERGENCY  PROCEDURES  IN  THE  BASIC  DESIGN 

The  autopilot  must  be  able  to  react  to  the  following  types  of  failures: 

°  Sensor  failures  which  are  self-detected  by  the  affected  sensors. 

0  Transmission  faults  of  serial-digital  data. 

°  Discrepancies  between  redundant  sensors. 

0  Discrepancies  between  the  commands  in  the  two  autopilot  computers. 

Sensor  failures  are  indicated  to  the  autopilot  by  a  status  bit  or  discrete  signal. 
Transmission  faults  are  detected  by  a  parity  check.  Redundant  sensor  signals,  i.e.  attitude 
angles  from  INS  and  SAHRS  and  air  data  from  ADC  and  TTU ,  are  monitored  against  each  other 
within  the  autopilot.  The  commands  generated  within  the  two  autopilot  computers  are  cross- 
monitored  at  various  stages  of  the  computation.  Fig.  2  shows  a  block  schematic  of  the 
cross-monitoring  for  the  pitch  command  generation.  The  cross-monitoring  for  the  roll  axis 
is  mechanized  in  a  similar  way. 


At/OPllO’  COMPt 

TEA  NO 

COMMAND 

NORMAl  ACCEl  DEMANC  | 

COMMAND 

GENERA-ON 

r 

CONVERSION 

SENS  OR 

S>GM>.5 


R'TChRA'E  3EMANC 


DETECTOff 


MORE  1 
NOSE  yP| 


MORE 
NOSE  uP 


MORE 

NOSE  jP 


O 


SENSOR 

S'GM.S 


*1 r0*lCr 
:omputER 

NO  2 


LEVEi 
lOETECTORl 


COMMAND 

GENERATION 

_ _ 

COMMAND 

CONVERSION 

TevEl I 


FIG.  2:  BLOCK  SCHEMATIC  OF  CROSS-MONITORING 
BETWEEN  AUTOPILOT  COMPUTERS 


After  detection  of  a  failure  the  autopilot  reacts  as  follows: 

If  one  of  the  attitude  sources  indicates  that  it  has  failed,  the  autopilot  automatically 
reverts  to  the  healthy  source  and  continues  flying  with  unraonitored  single  source.  The 
failure  is  indicated  on  the  Central  Warning  Panel. 

In  all  other  failure  cases  the  autopilot  is  automatically  disconnected  and  a  failure 
signal  is  transmitted  to  the  Central  Warning  Panel,  which  initiates  flashing  of  attention 
getters  and  audio  warning.  However,  autopilot  disconnect  plus  warning  are  not  sufficient 
to  recover  the  aircraft  in  all  failure  cases  during  low  level  flying.  Therefore,  immediately 
after  disconnect  of  the  normal  autopilot  commands,  which  might  be  affected  by  the  failure, 
an  automatic  pull-up/wings  level  manoeuvre  is  initiated  by  discharging  a  store  in  each  axis. 

Fig.  3  shows  how  the  autopilot  disconnect  and  open  loop  pull-up/wings  level  command 
generation  is  mechanized:  During  normal  operation  the  commands  to  the  CSAS  are  tracking 
a  command  fader  store  in  each  axis.  In  addition,  there  is  a  pull-up  store  and  a  wings  level 
store,  which  are  tracked  to  a  value  equivalent  to  the  available  g-margin  and  the  momentary 
bank  angle,  respectively.  At  autopilot  disconnect,  all  four  stores  are  isolated  and  dis¬ 
charged.  The  signals  from  the  pull-up  and  wings  level  stores  are  superimposed  to  the  signals 
from  the  command  fader  stores. 


Fig.  4  shows  the  time  histories  of  a  typical  pull-up/wings  level  manoeuvre. 


ROLL  WE 


FIG  3:  AUTOPILOT  OUTPUT  SECTION 
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FIG.  A:  OPEN  LOOP  PULL-UPSWINGS  LEVEL  PERFORMANCE 


5.  MEASURES  TO  IMPROVE  SYSTEM  INTEGRITY  IN  CASE  OF  COMPONENT  OR  SUBSYSTEM  FAILURES 

The  pitch  rate  demand  signal  is  in  the  final  stage  of  the  computation  fed  through  an 
integrator.  To  avoid  the  integrator  outputs  of  the  two  computers  diverging,  the  crossfeed 
error  is  fed  back  into  the  integrators  as  shown  in  Fig.  5.  A  limiter  on  the  crossfeed  error 
ensures  that  the  computer  outputs  are  synchronized  for  small  errors  only.  This  synchroniz¬ 
ation  is  achieved  at  the  expense  of  height  offsets.  To  avoid  negative  height  offsets,  in 
particular  in  the  low  level  modes,  the  symmetric  crossfeed  error  limiter  was  replaced  by 
an  asymmetric  one.  Fig.  6  shows  the  resulting  effect  upon  height  offsets  due  to  rate 
gyro  signal  offsets. 
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FIG  5:  SYNCHRONIZATION  OF  COMPUTER  OUTPUTS 


FIG.  6:  HEIGHT  OFFSETS  DUE  TO  ERRORS  ON  PITCH  RATE  SIGNAL  WITH 
SYMMETRIC  AND  ASYMMETRIC  CROSSFEED  ERROR  LIMIT 


The  vertical  acceleration  demand  signal  in  the  autopilot  is  limited  in  accordance  to 
the  manoeuvring  requirements  for  each  mode.  This  limitation  provides  a  protection  against 
undetected  sensor  runaways.  In  the  Terrain  Following  mode,  these  limits  are  relatively 
wide  for  both  positive  and  negative  demands.  A  negative  runaway  of  the  TF  Radar  command 
at  low  speed  represents  a  potential  hazard,  as  the  "g"  capability  during  a  subsequent 
recovery  manoeuvre  is  limited.  Therefore,  the  negative  vertical  acceleration  demand  limit 
was  scheduled  with  dynamic  pressure  to  reduce  the  effect  of  potential  negative  runaways 
(Fig.  7). 

In  case  of  a  detected  TF  Radar  failure,  automatic  terrain  following  must  be  interrupted 
and  a  pull-up  must  be  performed.  In  the  basic  design  this  was  achieved  by  autopilot  dis¬ 
connect  and  subsequent  open  loop  pull-up.  However,  since  the  autopilot  is  fully  available 
in  such  a  failure  case,  it  was  decided  to  introduce  a  closed  loop  pull-up/wings  level 
facility,  which  provides  a  controlled  recovery  manoeuvre.  Within  2  seconds  the  system  is 
able  to  automatically  return  to  TF,  if  the  failure  disappears.  Otherwise,  after  2  seconds 
the  autopilot  is  disconnected.  The  performance  of  the  closed  loop  pull-up  is  more  con¬ 
sistent  compared  to  open  loop  pull-up  for  different  configurations  and  flight  conditions. 
An  example  is  given  in  Fig.  8. 

Automatic  recovery  manoeuvres  must  not  only  clear  the  aircraft  from  the  ground  but 
also  avoid  unsafe  flight  conditions  as  a  consequence  of  exceeding  angle-of-attack  limits. 
To  ensure  that  the  aircraft  during  automatic  pull-ups  does  not  build  up  excessive  angles- 
of-attack,  the  normal  acceleration  demand  limiter  has  to  be  scheduled  with  flight  para¬ 
meters  and  aircraft  wing  sweep  (Fig.  9). 
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An  open  loop  pull-up  during  turning  flight  is  always  combined  with  an  open  loop  wings 
level  command,  which  is  a  function  of  the  bank  angle  at  the  instant  of  pull-up/wings 
level  initiation.  In  cases  of  a  failure  during  manoeuvres  with  high  roll  rate,  the  wings 

level  command  with  this  type  of  control  law  is  either  too  weak  or  too  large  to  achieve 

a  satisfactory  levelling  out  of  the  aircraft.  In  order  to  improve  the  wings  level  perform¬ 
ance  under  dynamic  conditions,  provisions  have  been  made  to  include  roll  rate  in  the  wings 
level  command  generation. 

Signal  discrepancies  between  the  two  computers  are  detected  by  the  various  crossfeed 
monitors,  if  the  monitor  thresholds  are  exceeded.  This  normally  leads  to  an  automatic 
autopilot  disconnect.  Since  the  detection  and  disconnect  are  controlled  by  software,  a 
delay  of  up  to  one  program  cycle  between  exceedance  of  threshold  and  operation  of  output 
switches  cannot  be  avoided.  To  prevent  nuisance  disconnects,  the  autopilot  is  disconnected 
only  if  a  threshold  is  exceeded  for  a  number  of  subsequent  cycles  (approximately  100  msecs) 
In  case  of  a  hardover  in  one  computer,  the  commands  will  go  right  to  the  maximum  value 
before  disconnect.  In  the  pitch  axis,  a  positive  hardover  would,  due  to  the  more  nose-up 

logic,  appear  on  all  three  output  channels  and  charge  the  fader  stores.  Such  a  hardover 

is  not  constrained  by  the  normal  acceleration  limits  and  would  lead  to  excessive  transients 
of  normal  acceleration  or  angle-of-attack . 

To  protect  the  aircraft  against  hardovers,  a  hardover  monitor  has  been  introduced 
(Fig.  10) .  This  monitor  (one  in  each  computer)  is  mechanized  in  hardware  and  reacts  within 
nsecs.  At  detection  of  a  hardover,  the  monitors  open  the  output  switches  and  thereby  pre¬ 
vent  the  hardover  being  transmitted  to  the  CSAS  and  stored  in  the  fader  stores.  The  per¬ 
manent  disconnect  is  carried  out  as  before  with  a  100  msec's  delay.  Therefore  single  spikes 
are  suppressed  but  do  not  lead  to  nuisance  disconnects.  Fig.  11  shows  the  size  and  duration 
of  discrepancies  which  are  tolerated  by  the  monitoring  system.  Discrepancies  exceeding  the 
given  boundaries  lead  to  error  suppression  and/or  disconnect. 
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FIG.  10:  BLOCK  SCHEMATIC  OF  HAROOVER  MONITOR 
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FIG.  IV.  AREA  OF  ERROR  TOLERATION 
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The  hardover  monitor  gives  protection  against  common  channel  hardovers  in  the  output 
lanes  due  to  single  failures  of  hardware  components.  However,  it  would  not  cover  the  case 
of  a  simultaneous  hardover  on  all  output  channels  due  to  a  discrepancy  in  the  autopilot 
software,  which  is  common  to  both  autopilot  computers.  A  nose-down  hardover  of  this  kind 
could  lead  to  excessive  height  loss  and  possibly  a  loss  of  the  aircraft  during  low  level 
flight. 

To  protect  the  aircraft  and  crew  against  such  a  remote  possibility  pending  completion 
of  all  software  testing,  authority  limits  on  the  autopilot  outputs  were  introduced  and 
the  disengagement  characteristic  was  optimized.  The  general  requirements  for  this  design 
change  were  as  follows: 

0  The  pilot's  authority  should  be  as  high  as  possible  compared  to  the  autopilot.  The  auto¬ 
pilot  authority  can  only  be  reduced  to  a  level  which  still  ensures  full  performance  during 
normal  operation  including  safe  recovery  after  any  kind  of  failure. 

°  The  task  of  the  output  faders  is  to  reduce  normal  disengage  transients.  However,  the 
faders  also  oppose  a  pilot's  recovery  stick  input.  Therefore,  the  fader  time  constants 
can  only  be  reduced  to  a  level  which  still  ensures  adequate  suppression  of  transients 
after  normal  autopilot  disengagement  and  at  the  same  time  gives  the  pilot  immediate  control 
over  the  aircraft  if  an  emergency  recovery  action  is  required. 

The  authority  limits  were  determined  to  allow  for  a  3  g  incremental  command  during 
closed  loop  pull-up  and  a  -1  g  pushover  command  during  normal  TF. 

It  has  been  demonstrated  by  simulation  that  the  authority  limits  and  the  reduced  fader 
time  constants  would  considerably  reduce  the  height  loss  during  recovery  after  a  common 
channel  nose-down  hardover.  Therefore,  the  introduction  of  this  change  was  an  important  step 
to  get  the  aircraft  cleared  in  the  automatic  low  level  modes. 

6.  MEASURES  INTRODUCED  TO  ENSURE  SYSTEM  INTEGRITY  WITH  REGARD  TO  THE  SOFTWARE  PROGRAM 

The  introduction  of  autopilot  authority  limits  and  minimization  of  output  fader  time 
constants  was  an  important  contribution  to  safety  in  the  presence  of  multiple  channel 
failures,  but  was  never  regarded  as  a  replacement  for  rigorous  testing  of  the  software. 

The  verification  of  error-free  software  was  a  prerequisite  for  getting  the  aircraft  re¬ 
leased  down  to  minimum  set  clearance  height. 

To  be  able  to  detect  any  possible  discrepancies  within  the  software  program,  a  so-called 
Cross-Software  Test  System  was  developed  (Fig.  12).  For  this  purpose,  the  autopilot  control 
laws  and  mode  and  failure  logic  were  once  more  programmed  in  a  dissimilar  manner,  i.e.  by 
using 

°  An  independent  programming  team, 

°  A  dissimilar  programming  language,  i.e.  High  Order  Language  C  with  floating  point 
arithmetic, 

"  A  dissimilar  computer,  i.e.  a  PDP  11/70. 

The  test  computer  beside  the  autopilot  model  includes  stimulation  functions  and  evalu¬ 
ation  routines  to  compare  autopilot  and  model  outputs  against  each  other. 
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In  particular,  tests  were  carried  out  in  the  following  areas: 

°  Variation  of  input  parameters  within  full  range, 

0  Initialization  of  integrators,  filters  and  limiters, 

°  Mode  switching. 

A  complete  test  included  50  hours  of  testing  with  a  total  of  5.6  million  test  points. 

The  efficiency  of  the  cross-software  test  method  was  demonstrated  by  the  fact  that  a 
number  of  minor  software  discrepancies  were  detected  with  this  test,  which  fortunately 
had  no  significant  effect  upon  safety  and  performance.  These  discrepancies  had  not  been 
found  during  years  of  ground  and  flight  testing.  The  confidence  in  the  software  gained 
by  this  test  was  the  necessary  final  step  to  obtain  full  clearance  of  the  low  level  modes 

7.  CONCLUSION 

The  following  measures  have  proven  to  be  effective  to  ensure  survivability  of  the 
aircraft  after  failures: 

(1)  As  a  basic  requirement  safety  critical  subsystems  (autopilot  computer,  sensors)  have 
to  be  made  redundant  to  allow  for  cross-monitoring  and  detection  of  single  component 

failures.  After  detection  of  a  significant  failure  emergency  procedures  must  be  automatic 
ally  initiated,  i.e.  automatic  autopilot  disconnect,  automatic  pull-up  and  wings  level 
manoeuvre  and  adequate  warnings  to  the  pilot. 

(2)  The  effect  of  failures  must  be  suppressed  or  reduced  by  command  limits  in  the  software 
hardover  protection  and  output  authority  limitation.  Automatic  recovery  manoeuvres 

must  be  optimized  to  give  the  pilot  optimum  conditions  for  take-over. 

(3)  Software  integrity  must  be  verified  by  efficient  testing. 

Practical  flying  experience  has  shown  that  the  above  safety  measures  are  efficient 
to  ensure  flight  safety  during  automatic  flying  including  low  level  modes. 


19-1 
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This  paper  briefly  describes  the  digital  Integrated  Flight  Control  System  (IFCS) 
developed  for  the  Jaguar  Fly-By-Hire  (FBU)  demonstrator  programme,  iaentifying  the 
specification  requirements,  resultant  architecture,  implementation  and  the  incorporated 
self  test  capability.  The  redundancy  management  aspects  of  the  IFCS  are  described 
together  with  the  techniques  for  providing  the  pilot  with  relevant  information  to 
determine  the  IFCS  redundancy  status.  Particular  emphasis  is  given  to  the  software 
definition  and  preparation  procedures,  and  the  comprehensive  integrity  appraisal  leading 
to  flight  clearance  of  the  system. 

Following  the  extensive  rig  proving  of  the  system,  the  early  phases  of  flight  test  were 
very  successfully  carried  out  using  the  fixed  gain  control  laws.  During  this  perioo  a 
major  software  update  was  commenced  to  incorporate  the  scheduled  gain  control  laws  ana 
to  enhance  the  self  test  capability.  The  software  segregation  introduced  at  this  stage 
is  described,  together  with  the  experience  obtained  in  recertifying  the  system.  Flight 
testing  of  the  scheduled  control  laws  is  continuing,  and  the  minor  problems  encountered 
are  mentioned.  A  further  software  revision  to  include  the  control  laws  for  the 
statically  unstable  aircraft  is  well  advanced,  and  the  benefits  of  software  segregation 
identified  during  this  revision  are  described. 

The  reliability  of  the  aircraft  and  IFCS  have  proved,  to  date,  to  be  excellent.  Thus 
practical  in-flight  results  of  the  systems  ability  to  absorb  and  survive  fault 
conditions  are  minimal.  The  redundancy  management  and  integrity  experience  provided  by 
the  programme  has  therefore  principally  been  in  the  theoretical  analysis  supported  by 
controlled  experimentation  on  the  rig.  These  exercises  have  highlighted  key  areas  of  the 
system  and  software  design  techniques  which  enable  these  aspects  to  be  fully  and 
economically  evaluated.  These  areas  are  described,  with  mention  of  how  these  techniques 
are  being  developed  to  simplify  and  improve  the  exercise  for  future  high  integrity 
digital  flight  control  systems. 

1.  AIRCRAFT  AND  SYSTEMS  DESCRIPTION 
1.1.  Aircraft 

The  FBH  Jaguar  demonstrator  aircraft  is  a  modified  single  seat  SEPECAT  Jaguar.  Internal 
modifications  were  made  to  accommodate  the  IFCS  computers  and  extensive  instrumentation, 
and  all  of  the  original  mechanical  control  rods,  autostabiliser  equipment  ana  powered 
flight  control  units  were  removed.  A  third  Transformer  Rectifier  Unit  (TRU)  was  added  to 
cover  the  additional  loading  of  the  fly-by-wire  system  and  instrumentation,  and  revised 
power  distribution  was  introduced  to  meet  the  power  supply  integrity  requirements  of  the 
IFCS. 

Three  independent  28V  bus  bars,  each  battery  backed,  are  supplied  by  the  three  TRU,  and 
each  computer  of  the  IFCS  consolidates  power  from  two  of  these  bus  bars  as  shown  in 
Figure  1 . 

The  two  engine  driven  hydraulic  pumps  were  replaced  by  units  with  greater  capacity,  and 
the  emergency  e  1  ec t rohydr au l i c  pump  was  replaced  by  two  pumps  of  greater  capacity  each 
driven  by  one  of  the  independent,  battery  backed,  28V  bus  bars.  These  provide  two 
independent  hydraulic  systems,  each  with  an  emergency  supply  primarily  to  power  the 
flying  control  actuators,  the  system  including  provision  for  priority  valves  if  found 
necessary.  The  standard  power  transfer  unit,  allowing  transfer  of  power  but  not  fluid 
between  systems,  is  retained. 

Externally  the  aircraft  is  little  changed,  though  later  in  the  trials  programme  leading 
edge  strakes  will  be  fitted  along  the  air  intake  boxes.  Provision  is  made  for  fixed 
ballast  to  be  carried  in  the  rear  fuselage,  and  this  together  with  fuel  management 
procedures  enable  the  centre  of  gravity  to  be  moved  aft  to  give  a  manoeuvre  point  of 
-3XT  to  -5XT.  The  leading  edge  strakes  will  move  the  centre  of  pressure  forward  to  give 
a  manoeuvre  point  of  -10XT. 
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Figure  1  Flight  Control  System  Primary  Power  Distribution 


1.2.  Integrated  Flight  Control  System 

The  system  architecture  shown  in  Figure  2  was  evolved  to  meet  the  following 

specification  requirements. 

•  Overall  system  loss  probability  (including  first  stage  actuation)  shall  be  no 
greater  than  10-7  per  hour. 

Any  two  electrical  failures  in  the  system  shall  be  survived. 

The  electrohydraul ic  first  stage  actuation  would  have  only  two  independent 
hydraulic  supplies  with  no  interconnection  between  them. 

•  The  system  shall  survive  a  hydraulic  system  failure  followed  by  an  electrical 
system  failure  or  an  electrical  failure  followed  by  a  hydraulic  failure. 

•  The  system  shall  rely  on  majority  voting  of  the  redundant  elements  for  failure 
survival  rather  than  self-monitoring  within  each  redundant  element. 

•  Similar  redundant  digital  implementation  shall  be  adopted  without  any  reliance  on 
any  back-up  flight  controls  (e.g.  mechanical  or  analogue  links). 


Figure  2  System  Architecture 


These  requirements  led  to  the  incorporation  of  the  duo-triple*  actuation  system, 
developed  by  Dowty  Boulton  Paul,  to  drive  the  rudder,  two  taileron  and  two  spoiler 
control  surfaces.  The  five  Powered  Flying  Control  Units  (PFCU)  are  essentially  similar, 
with  variations  in  valve  ports,  jack  strokes  and  diameters.  Each  PFCU,  schematically 
shown  in  Figure  3,  contains  si*  flapper  nozzle  servo  valves  which  convert  electrical 
inputs  from  the  Flight  Control  Computers  (FCC)  and  Actuator  Drive  and  Monitor  Computers 
IADMC)  into  hydraulic  signals  which  are  then  used  to  drive  a  pair  of  first  stage 
spoo l / con t ro l  valves.  Each  servo  valve  is  connected  to  two  pairs  of  opposing  pistons 
inside  one  of  these  first  stage  actuators.  The  pistons  act  on  flanges  mounted  on  the 
actuator  spools,  two  pairs  being  used  to  prevent  assymmetric  loading.  Both  flanges  are 
therefore  driven  by  si*  pairs  of  opposing  pistons,  two  pairs  from  each  of  three  servo 
valves.  A  mechanical  link  between  the  two  actuators  ensures  that  the  spools  and  thus 
the  flanges  move  in  unison,  so  that  all  six  servo  valve  outputs  are  effectively  summed 
together.  In  this  way  failures  in  at  least  two  lanes  can  be  absorbed  within  the 
actuators,  the  four  good  lanes  overriding  the  failed  lanes. 

A  separate  hydraulic  supply  feeds  each  trio  of  servo  valves  associated  with  the  first 
stage  actuators  and  is  also  routed  through  the  first  stage  actuator  to  the  co r respono  i  ng 
jack  of  the  conventional  tandem  power  control  unit.  Thus  failure  of  either  hydraulic 
supply  can  be  tolerated  by  the  PFCUs  in  addition  to  at  least  one  electrical  failure  that 
affects  the  computing  driving  the  side  of  the  actuator  unaffected  by  the  hydraulic 
fault. 

This  actuation  architecture  requires  6  independent  drive  signals  to  each  actuator,  Dut 
the  remaining  integrity  objectives  do  not  necessitate  the  cost  and  complexity  of  a  full 
si*  lane  system.  The  Flight  Control  System  (FCS)  is  therefore  essentially  a  quadruple* 
digital  system  with  special  facilities  to  provide  the  additional  independent  drives  to 
the  actuators.  All  mechanical  rods  downstream  of  the  trim  and  feel  units  have  been 
removed,  thus  there  is  no  mechanical  or  independent  back  up  reversion. 

Ouadruple*  Position  Sensors  (QPS)  are  used  to  sense  pilot  control  demands  in  terms  of 
stick,  pedal  and  trim  inputs  and  quadruple*  rate  gyros  sense  aircraft  pitch,  roll  ano 
yaw  rates.  Four  identical  digital  FCC  are  used  to  process  these  signals  together  with 
those  from  other  sensors.  The  resulting  command  signals  are  used  to  control  the 
actuators.  To  convert  the  quadruple*  signals  from  the  FCCs  into  the  sextuple*  signals 
required  by  the  actuators,  the  FCCs  are  supplemented  by  two  ADMC . 
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Figure  3  Duo-triplex  Actuator  Scheae 


Figure  A  shoes  the  schematic  of  an  ADBC  which  receives  optically  coupled  signals  froa 
all  four  FCC,  converts  thea  to  analogue  and  votes  thea  to  provide  a  consolidated, 
essentially  Independent  output. 


Figure  4  Actuator  Drive  and  Monitor  Computer  Schematic 
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The  Jaguar  FBW  system  configuration  is  illustrated  in  Figure  2  which  presents  a 
simplified  schematic  of  the  primary  control  path.  In  addition  to  the  quadruplex  primary 
input  sensors,  sensors  of  lower  redundancy  are  used  for  those  functions  which  may  be 
necessary  for  optimum  handling  qualities  but  which  are  not  necessary  for  sa*t  flight. 
These  are  dynamic  pressure,  static  pressure,  incidence  and  sideslip  which  are  all 
triplex  sensors;  and  lateral  acceleration,  flap  position  and  airbrake  position  which  are 
duplex  sensors.  Triplex  dynamic  and  static  pressures  are  provided  by  three  pitot  static 
probes  (the  standard  nose  boom  and  two  side  mounted  probes).  Triplex  incidence  and 
sideslip  signals  are  provided  by  four  Airstream  Direction  Detector  probes  (ADD)  mounted 
around  the  nose  of  the  aircraft. 


The  FCS  also  uses  a  number  of  quadruplex  and  duplex  discrete  inputs  for  switching 
functions.  A  simplified  overall  system  configuration  is  illustrated  in  Figure  5.  Cross 
lane  data  transmission  is  achieved  via  dedicated,  optically  coupled  serial  data  links  as 
shown  in  Figure  6.  Voting  and  failure  rejection  logic  in  each  computer  maximises  the 
system  failure  absorption  capability  and  ensures  the  the  system  is  able  to  survive  two 
sequential  failures  of  all  primary  input  and  feedback  sensors.  The  system  is  designed  to 
run  synchronously,  but  has  been  operated  assynchronously  for  considerable  periods 
without  observable  degradation  of  performance.  A  more  detailed  description  of  the  system 
architecture  and  the  system  LRUs  can  be  found  in  reference  1. 


The  system  includes  comprehensive  Bu i l t- I n-Te s t  (BIT)  features  which  were  specified  to 
provide  an  accurate,  decisive,  and  repeatable  method  of  measuring  equipment  functional 
characteristics.  In  particular  the  BIT  is  used  to  clear  the  system  in  the  aircraft  prior 
to  each  flight  thus  its  integrity  and  fault  detection  ability  have  to  be  compatible  with 
the  overall  integrity  of  the  system.  The  facility  developed  has  met  the  objectives  and 
provides  an  invaluable  aid  to  FCS  commissioning  on  the  aircraft  and  reclearance  of  the 
FCS  following  Line  Replaceable  Unit  (LRU)  changes.  A  pilots  Control  and  Switch  Panel, 
shown  in  Figure  8,  provides  system  status  indication  to  the  pilot.  Status  signals  from 
the  Flight  Control  Computers  are  consolidated  to  illuminate  a  STATUS  amber  warning 
(first  failure)  or  red  warning  (similar  second  failure).  The  pilot  may  attempt  a  reset, 
when  an  amber  warning  is  given,  by  pressing  the  STATUS  button.  If  the  detected  disparity 
is  no  longer  present  the  system  will  return  to  full  operation  status  and  the  warning  is 
extinguished.  A  red  warning  inhibits  the  status  reset  facility.  Separate  status 
indicators  are  provided  for  the  secondary  sensors.  The  panel  also  carries  the  autopilot 
engage  buttons,  the  BIT  initiate  button,  a  facility  to  select  different  control  law 
gains,  and  power  switches  to  isolate  the  supplies  to  the  computers  to  enable  pre-flight 
check  of  the  power  supply  consolidation  within  these  units. 

The  FCS  Equipment  has  been  developed  to  production  standards,  as  shown  in  Figures  7,  8, 
9  and  10,  and  qualification  tests  have  been  completed. 


Figure  5  Flight  Control  System  Configuration 
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FLIGHT  RESIDENT  SOFTWARE 


Int  roduc  t i on 


Both  the  system  specification  requirements,  and  cos t / t i mesca le  considerations  oictated 
the  use  of  common  high  integrity  soft-ware  in  all  lanes  of  the  FCS.  There  is,  therefore 
the  possibility  of  introducing  design  limitations  via  the  software  that  coula  result  in 
a  common  mode  malfunction  of  the  system  and  a  subsequent  safety  critical  loss  of 
control.  To  contain  this  problem  software  structures  and  design  procedures  have  been 
evolved  over  several  digital  FCS  programmes.  These  maximise  the  visibility  of  the 
software  to  facilitate  thorough  test  and  functional  audit  during  the  design  phase.  These 
are  supplemented  by  clear  requirements  definitions,  detailed  documentation,  and  rigorous 
production  and  configuration  control  procedures. 

2.2.  Flight  Software  Organisation 

The  real  time  control  is  achieved  by  a  hardware  Master  Reset  Timer  which  calls  a  non 
interruptable  Executive.  The  Executive  then  calls  the  Frames  (processing  time  slices 
containing  related  functional  modules)  in  a  defined  sequence  to  provide  the  required 
iteration  rates  for  the  various  computing  paths.  Each  Frame  typically  contains  control 
laws,  with  related  signal  selection  and  logic  module  functions,  and  consists  of  a  set  of 
program  modules  each  defining  a  function  that  is  easily  defined,  implemented,  tested  and 
audited.  The  worst  case  run  time  of  a  Frame  is  controlled  at  the  design  stage  to  ensure 
that  the  computing  task  is  completed  before  the  Master  Reset  occurs.  Should  any  fault 
occur  that  causes  the  Frame  run  time  to  exceed  the  Master  Reset  time  interval,  this  is 
detected  and  flagged  as  a  computer  fault. 

The  structure  of  the  flight  resident  program  is  shown  schematically  in  Figure  11. 


CONTROL  FLOW  -  EXECUTIVE  &  FRAMES 
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Figure  11  Flight  Resident  Program  Structure 


19-12 


2.3.  Flight  Software  Development  Process 

The  key  documents  controlling  the  software  design  are  the  Software  Requirements  Document 
(SRD)  and  the  Software  Structure  Document  (SSD),  prepared  in  conjunction  with  BAe  from 
their  basic  software  specification,  control  law  definition  and  interface  documents. 

The  SRD  uses  English  language  and  program  statements  to  define  the  design 
imp l ement a t i on .  These  statements  are  formed  to  eliminate  definition  ambiguity  ana  form 
the  basis  of  definitive  software  design  specifications  which  are  testable  to  prove  the 
accuracy  of  the  definition. 

The  SSD  defines  the  running  order  of  the  modules  within  the  program  segments.  The 
structure  is  designed  to  ensure  that  chronological  flow  of  data  from  input,  through 
processing,  to  output  is  in  strict  sequence. 

An  important  aspect  of  the  initial  software  design  process  is  the  definition, 
optimisation  and  validation  of  the  frequently  used  algorithms,  particularly  those 
associated  with  system  integrity  such  as  signal  consolidation  and  monitoring.  MAv 
developed  6  different  voter  monitor  algorithms  to  cover  the  range  of  analogue  and 
discrete  signals  at  various  redundancy  levels,  together  with  many  other  filter  and 
schedule  routines. 

The  codes  of  practise  used  in  designing  and  testing  the  Flight  Resident  Software  FRS  are 
defined  in  the  Programmers  Manual  and  the  Testers  Manual.  These  also  define  the 
procedures  and  documentation  requirements  for  configuration  and  quality  assurance 
cont  ro  l . 

The  target  processor  structure,  input/output  requirements,  and  the  task  orientated 
instruction  set,  are  also  rigorously  defined. 

The  overall  software  develop»t''t  process  is  shown  d i ag rammat i ca l l y  in  Figure  12.  The 
software  requirements  documents  are  interpreted  to  produce  software  module  Design 
Specifications,  which  include  definition  of  the  module  implementation  in  the  form  of 
FORTRAN  statements.  These  high  level  language  statements  are  then  coded  into  the  macro 
assembler  statements  used  by  the  FCC  processor,  supported  by  FORTRAN  comment  statements 
to  improve  code  visibility.  A  library  of  well  proven  macros  has  been  established  which 


Figure  12  Software  Development  Process 
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covers  some  70X  of  the  data  management  and  control  law  software  requirements.  A 
corresponding  Design  Report  is  produced  listing  the  assembled  code  for  the  module 
together  with  details  including  run  time,  storage  requirements,  design  programmer, 
module  ident,  progress  card  reference,  and  relevant  design  calculations.  A  Module  Test 
Specification  is  written  by  another  programmer  who  has  neither  designed  nor  coded  the 
relevant  module.  This  procedure  minimises  the  possibility  of  carrying  a  module  design 
error  through  to  the  test  specification.  The  module  code  is  then  tested  on  a  host 
computer  using  the  specified  test  harness,  and  the  results  are  recorded  in  a  Module  Test 
Report . 

The  module  documentation  is  audited  by  senior  programmers  to  ensure  that  the  code 
accurately  represents  the  design  requirements  and  that  all  design  rules  such  as  single 
entry,  single  exit,  all  decision  logic  in  the  forward  direction  etc.  have  been  observeo. 
The  audit  also  ensures  that  the  test  rules  have  been  followed  including  all  paths 
through  the  module  have  been  exercised  and  that  sufficient  intelligent  testing  has  been 
defined  to  check  over f  l  ow/ sa t ura t i on  conditions  for  the  module.  The  test  results  are 
correlated  with  the  test  specification  requirements  to  ensure  all  tests  are  complete  and 
accurate,  and  the  documentation  is  checked  for  completeness. 

When  all  the  modules  are  completed  the  code  is  assembled  into  the  frames  and  then  the 
full  Flight  Resident  Software  (FRS)  with  similar  testing,  reporting  and  audit  at  each 
stage.  End  to  end  tests  are  carried  out  on  the  fuLly  assembled  programme  using  the  host 
computer  before  generation  of  the  PROM  device  code  for  transferring  the  FRS  to  the 
target  computers.  At  this  stage  the  Quality  Assurance  department  complete  their  audit  of 
the  software  preparation  process,  check  the  PROM  device  code  review  the  design  and 
configuration  documentation,  and  if  all  is  satisfactory  release  the  software  for  formal 
issue. 

The  development  and  testing  of  high  integrity  FRS  for  Flight  Control  Systems  has  been 
carried  out  on  several  host  computers  using  'in  house'  developed  software  tools 
progressively  enhanced,  and  proven  by  duplicate  assemblies  on  successive  host  computers. 
The  result  is  a  suite  of  well  proven  support  programmes.  These  programmes  include  the 
macro  expander,  assembler,  simulator,  PROM  code  generator  and  test  result  annotator. 
Each  includes  routines  to  check  valid  usage  of  instructions,  storage,  work  space,  run 
time  etc.  Any  deviation  from  the  rules  in  these  areas  inhibits  the  generation  of  the 
final  code  and  the  PROM  device  code. 

The  SRD,  SSO,  design  and  test  documents.  Programmers  and  Testers  Guides,  the  generated 
code  and  the  host  computer  software  are  under  strict  configuration  control  from  the 
initial  issue.  Changes  can  only  be  introduced  by  formal  Change  Requests  which  are 
authorised  by  the  Chief  Programmer  and  the  Project  Manager.  Build  Standards  identify  the 
documentation  issues  and  Change  Requests  applicable  to  each  issue  of  the  software. 

The  production  of  the  software  is  controlled  using  Progress  cards  which  are  identical  to 
those  used  for  controlling  manufacture  of  hardware.  These  cards  create  a  historical 
record  of  all  stages  of  the  software  development,  and  the  identities  of  the  programmers 
completing  each  task.  All  relevant  Change  Requests  are  recorded  on  the  card  which  can  be 
used  to  trace  the  development  of  the  module  through  all  design,  test  and  analysis 
phase  s . 

Strict  adherence  to  the  above  techniques  generates  highly  visible  FRS,  fully  audited, 
well  tested  and  inherently  of  the  required  integrity. 


3.  INTEGRITY  APPRAISAL 

The  complexity,  novelty  and  specified  requirements  for  the  IFCS  necessitated  a  major 
work  programme  to  appraise  the  resultant  integrity.  The  technique  employed  analysed  the 
system  integrity  assuming  perfect  implementation,  and  subsequently  audited  the 
implementation  to  assess  the  effects  of  possible  faults  and  design  defects. 

The  integrity  of  the  IFCS  is  primarily  determined  by  the  system  architecture.  Therefore 
the  elements  of  maximum  concern  are  the  points  where  the  redundant  lanes  are 
consolidated  or  otherwise  connected,  together  with  the  potential  for  common  mode  safety 
critical  design  defects  in  the  hardware,  firmware  or  software. 

The  appraisal  was  carried  out  using  both  'bottom  up'  and  'top  down'  analyses,  and  since 
some  of  the  issues  involved  could  not  lead  to  useable  quantitative  estimates  of  risk, 
qualitative  assessments  were  also  necessary. 

The  main  elements  and  interactions  of  the  appra i sa l / aud  i  t  methodology  are  shown  in 
Figure  13  and  included:- 

i)  1 00*  coverage  single  fault  Failure  Modes  and  Effects  Analysis  ( FME A ) . 

ii)  Multiple  fault  FMEA  for  specific  combinations, 

ii)  Flight  resident  software  audit. 

iv)  Appraisal  of  special  areas. 

v)  Configuration  inspection. 

vi)  Qualification  programme. 

vii)  Burn-in  programme. 
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Figure  13  Integrity  Appraisal 


These  primary  elements  were  supported  by 

a)  Module,  chassis  and  LRU  FME A . 

b)  Microprogram  appraisals. 

c)  Vote r /moni tor  appraisals. 

d)  Tdlerance  analyses. 

e)  BITE  coverage  analyses. 

f)  System  architecture  analyses. 

g)  Reliability  analyses. 

During  the  course  of  the  appraisal  detailed  technical  evaluations  of  various  features 
and  functions  of  the  IFCS  were  made.  The  requirements  for  these  evaluations  were 
generated  mainly  from  the  FMEA  activity,  and  by  BAe  as  a  result  of  their  test 
activities.  These  evaluations  were  reported  as  a  series  of  Technical  Appraisals  appended 
to  the  overall  integrity  report,  and  their  results  incorporated  into  the  risk 
assessment . 

The  integrity  appraisal  was  conducted  by  a  team  with  specialist  knowledge  of  the 
equipment  design,  but  to  ensure  rigour  in  the  appraisal  they  reported  to  an  independent 
authority  consisting  of  senior  engineers  from  MAv  and  BAe. 

An  essential  part  of  the  system  clearance  depended  on  the  extensive  emulator,  rig  and 
aircraft  testing  carried  out  at  BAe,  Warton.  During  these  exercises,  any  unexpected 
observation  that  could  not  immediately  be  explained  by  the  personnel  involved  in  the 
test  resulted  in  the  raising  of  a  formal  query.  A  written  response  to  every  query, 
approved  by  both  BAe  and  MAv,  was  a  mandatory  requirement  for  final  a.  A.  clearance  of 
the  aircraft  for  flight. 

A  fully  detailed  description  of  the  system  integrity  appraisal  can  be  found  in  Reference 

2. 


4.  FLIGHT  TESTING 

Following  extensive  rig  and  aircraft  ground  trials,  including  a  considerable  amount  of 
electromagnetic  compatibility  (EMC)  and  power  supply  transient  testing,  the  first  flight 
took  place  on  20th  October  1981.  Flight  testing  of  the  fixed  gain  control  laws  was 
completed  in  13  flights,  compared  with  the  14-22  flights  budgetted.  The  aircraft  proved 
easy  and  straightforward  to  fly  with  excellent  FCS  reliability.  The  flying  rate  of  the 
aircraft  was  never  limited  by  any  problems  within  the  FCS  but  solely  by  the  large 
amounts  of  data  to  be  analysed  between  each  flight. 

During  this  4  month  period  only  one  FCS  LRU  was  exchanged  due  to  a  defect.  The  LRU 
change  was  prompted,  during  routine  servicing,  by  BIT  detection  of  a  spurious  cross  lane 
data  transmission  malfunction.  No  in-flight  computing  malfunctions  occurred  throughout 
these  trials.  A  single  inflight  FCS  failure  warning  occurred  just  prior  to  landing  on 
Flight  13,  caused  by  a  delay  in  the  quadruples  switch  on  the  undercarriage  selector. 
This  switch  is  a  standard  Jaguar  part,  and  the  possible  delay  between  operation  of  the 
two  pairs  of  switch  contacts  could  exceed  the  time  specified  in  the  interface  documents. 

The  FCS  detected  this  delay  on  a  slow  undercarriage  selection  and  correctly  diagnosed  a 
virtually  simultaneous  similar  double  failure  resulting  in  an  FCS  RED  warning  to  the 
pilot.  However  the  redundancy  management  logic  successfully  dealt  with  this  situation 
and  provided  the  correct  mode  selection  to  the  control  laws  and  an  otherwise  uneventful 
landing  was  achieved.  After  this  particular  flight,  the  in-flight  BIT  failure 
identification  table  (FIT)  was  interrogated  via  the  system  Diagnostic  and  Display  Unit 
(DDU)  and  immediately  Identified  the  cause  of  the  warning.  Recurrence  of  the  problem  was 
prevented  by  a  software  change  to  increase  the  acceptable  time  delay  between  the 
operation  of  the  switch  contacts.  Pilot  confidence  In  the  serviceability  of  the  system 
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prior  to  each  flight  was  enhanced  by  the  thoroughness  of  the  BIT  function  which  is  a 
pre-requisite  for  system  engagement.  For  this  demonstrator  aircraft,  the  BIT  requires 
pilot  interaction  which  could  be  automated  to  a  large  extent  in  a  production  aircraft 
environment.  However,  even  this  BIT  could  be  completed  in  about  three  minutes. 

For  further  details  of  ground  and  initial  flight  testing  of  the  1FCS  see  reference  3. 


5.  SOFTWARE  REVISION  AND  FURTHER  SYSTEM  TESTING 

5.1.  Scheduled  Control  Laws  tor  Stable  Aircraft 

Immediately  following  certification  of  the  initial  issue  of  FRS,  a  revision  was 
commenced  to  incorporate  scheduled  gain  control  laws,  to  enhance  the  BIT  function  and  to 
rectify  problems  encountered  during  the  early  trials  which  had  not  necessitated 
immediate  correction.  This  proved  to  be  a  very  extensive  modification  exercise  resulting 
in  changes  to  some  75X  of  the  400  modules  comprising  the  FRS.  However  the  timescale  and 
cost  of  preparing  the  new  issue  was  very  much  less  than  for  the  initial  issue,  and  by 
building  on  the  system  integrity  appraisal  techniques  established  tor  the  previous 
system  standard,  the  certification  was  achieved  with  less  than  20X  of  the  effort 
required  previously.  The  major  changes  in  system  performance  required  were  achieved  with 
only  the  single  hardware  modification  which  changed  the  contents  of  the  programme  store 
dev  ices. 

Recognising  the  problems  of  cost,  timescale  and  integrity,  associated  with  software 
modifications,  it  was  agreed  at  this  stage  to  be  cost  effective  for  additional  software 
segregation  to  be  introduced  to  the  FRS.  The  21K  words  of  software  required  were 
partitioned  across  26K  words  of  store.  This  was  organised  not  only  to  provide  software 
segregation  at  module  and  segment  level,  but  also  to  contain  different  sections  of 
software  within  separate  programme  store  devices.  The  objective  was  to  enable  future 
software  changes  to  be  contained  to  a  minimum  number  of  software  modules  and  programme 
store  devices.  Thus  bit  for  bit  comparison  of  successive  FRS  assemblies  would  easily 
identify  the  change  areas  and  enable  subsequent  verification  and  validation  to  be  more 
localised  than  could  be  justified  if  the  new  assembly  changed  all  of  the  programme  store 
instruction  locations. 

5.2.  Lightning  Testing 

Lightning  protection  measures  were  designed  and  buiLt  into  the  FCS  and  it's  aircraft 
interfaces,  and  extensive  EMC  susceptibility,  bulk  current  injection  and  transient 
testing  carried  out  before  the  first  flight.  However,  the  effects  of  a  lightning  strike 
on  an  aircraft  are  unpredictable  due  to  the  complex  interactive  effects  of  the 
structure,  equipment  layout  and  cable  runs.  Thus  for  the  early  flight  trials  the 
aircraft  was  prohibited  from  flying  in  areas  where  lightning  activity  was  likely. 
Subsequently  a  series  of  simulated  whole  aircraft  Lightning  tests  were  carried  out  to 
evaluate  the  effectiveness  of  the  design  to  protect  the  FCS  from  large  electromagnetic 
pulses  and  thence  to  obtain  a  relaxation  of  the  flight  restrictions. 

In  conjunction  with  the  Lightning  Studies  Unit  from  Culham  (UKAEA)  and  RAE  Farnborough, 
the  tests  were  carried  out  by  BAe  Warton.  The  simulated  lightning  pulses  were  produced 
by  discharging  a  high  voltage,  high  di/dt  generator  into  the  aircraft  at  the  base  of  the 
pitot  probe.  Conductors  forming  a  frame  around  the  aircraft  were  connected  to  various 
parts  of  the  aircraft  structure,  e.g.  tail  cone  or  fin  tip,  to  form  the  return  path  for 
the  high  current  pulses  and  create  the  required  electric  field  around  the  airframe. 
Extensive  monitoring  was  employed  with  the  measured  results  being  transmitted  to  the 
screened  recording  room  via  fibre  optic  data  links.  Further  details  of  these  tests  can 
be  found  in  references  4  and  5. 

Test  pulses  up  to  80KV  and  100KA  were  discharged  into  the  aircraft  configured  into  an 
effectively  ' f l i gh t- ready '  condition,  with  electrical  and  hydraulic  systems  powered  and 
the  FCS  operating.  These  pulses  represent  moderate  to  severe  lightning  strikes  yet  there 
was  no  measurable  or  observable  corruption  or  interference  of  the  FCS  function.  This 
has  generated  considerable  confidence  in  the  design  techniques  used  to  provide  lightning 
protection  for  the  FCS  on  the  Jaguar  aircraft,  but  extrapolation  of  the  results  is 
necessary  to  prove  the  case  tor  rescinding  the  flight  restrictions,  MAv  are  extending 
these  tests  by  subjecting  representative  interface  circuits  to  transient  voltages 
defined  by  Culham  as  a  result  of  the  measurements  taken  during  the  whole  aircraft 
lightning  tests.  These  transients  are  essentially  single  pulses  but  with  controlled 
rise,  decay  and  damping  characteristics  to  accurately  simulate  the  extrapolated  effects 
of  an  extreme  lightning  strike. 

The  Jaguar  Fly-By-Wire  Demonstrator  subsequently  became  the  first  aircraft  to  fly  after 
being  subjected  to  whole  aircraft  simulated  lightning  tests. 

5.3.  Flight  Test  of  Scheduled  Control  Laws 

The  rig  and  early  aircraft  ground  trials  of  the  scheduled  control  laws  detected  several 
peculiarities  and  faults.  Intermittent  data  transmission  errors  were  detected  during 
BIT,  and  an  Initially  inexplicable  Incorrect  FCS  status  was  occasionally  seen  at  the  end 
of  the  pre-flight  BIT.  Several  in-flight  secondary  sensor  failures  were  also  recorded. 
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The  majority  of  these  problems  were  easily  identified  and  diagnosed  by  use  of  the  BIT 
and  interrogation  of  the  Failure  Identification  Tables.  These  were  corrected  by 
attention  to  screening  and  changes  of  secondary  sensors.  However,  after  several  early 
observations  the  problem  which  caused  the  incorrect  post  BIT  status  of  the  FCS  became  so 
infrequent  that  efforts  to  capture  the  history  of  events  leading  up  to  it  were 
unsuccessful.  Resolution  of  the  problem  prior  to  commencing  the  flight  testing  therefore 
became  dependent  on  theoretical  analysis  of  the  software  to  predict  the  possible 
causes.  The  structured  form  of  the  FRS,  and  the  achieved  visibility  of  the  code,  enabled 
the  investigation  team  to  establish  that  there  was  only  one  possible  way  for  this 
situation  to  develop.  Subsequent  review  of  the  recorded  facts  on  the  incidents,  and 
controlled  tests,  demonstrated  beyond  reasonable  doubt  that  this  analysis  was  correct. 
The  situation  was  caused  by  occasionally  adopting  an  incorrect  procedure  that  could  only 
be  initiated  when  particular  test  equipment  was  connected  to  the  system,  and  therefore 
could  not  occur  in  flight. 

The  objective  of  this  phase  of  flight  testing  was  to  assess  the  aircraft  hanaling  with 
scheduled  control  laws,  check  training  and  spin  recovery  modes  and  complete  the  flutter 
envelope  expansion  with  a  modified  standard  of  taiLplane  actuator.  Testing  of  the 
aircraft  continued  with  stores  to  reduce  the  manoeuvre  margin  in  preparation  for 
subsequent  relaxed  stability  and  unstable  flight  trials.  At  the  time  of  writing  this 
paper  these  trials  were  approaching  a  successful  conclusion. 

5.4.  Scheduled  Control  Laws  for  Unstable  Aircraft 

Further  revision  of  the  software  was  required  to  incorporate  the  control  laws  to 
optimise  aircraft  performance  in  the  unstable  configuration  created  by  addition  of 
ballast  and  fuel  management  techniques.  This  revision  required  much  less  change  than  the 
previous  revision,  therefore  overall  comparison  of  the  tasks  cannot  be  used  to  assess 
the  benefits  obtainable  from  the  introduction  of  segregation.  However  at  the  individual 
change  level,  clear  benefits  have  been  observed.  This  s  particularly  the  case  for  late 
changes  or  corrections  which  could  be  isolated  to  a  single  programme  store  device 
change. 

Significant  reduction  in  FRS  modification  time,  PROM  code  generation  and  hardware 
reprogramming  has  been  achieved.  Combined  with  increased  confidence  in  the  fidelity  of 
the  unchanged  parts  of  the  programme,  these  have  dramatically  reduced  the  time  to 
introduce  and  prove  late  changes  immediately  prior  to  the  formal  validation  and 
verification  process.  As  yet  the  programme  has  not  reached  a  stage  where  formal 
recertification  of  the  system  after  a  small  FRS  revision  has  been  attempted.  It  is  not, 
therefore,  possible  to  state  the  benefits  that  segregation  provides  for  this  activity, 
but  it  is  predicted  that  these  could  be  very  significant. 

Flight  trials  of  the  unstable  aircraft  control  laws  are  scheduled  to  commence  in  June 
1983,  with  aircraft  centre  of  gravity  being  progressively  moved  aft  to  introduce 
negative  static  stability. 

Further  minor  changes  to  the  control  laws  are  now  being  defined  to  optimise  the  system 
for  flying  the  aircraft  with  the  leading  edge  strakes  fitted.  These  trials  should  take 
place  later  in  1 983 . 


6.  EXPERIENCE  OBTAINED  IN  DIGITAL  FCS  DEVELOPMENT  AND 
CERTIFICATION 

The  principal  aim  of  the  Jaguar  Demonstrator  aircraft  programme  has  been  to  establish 
the  feasibility  of  high  integrity  digital  fly-by-wire  systems  for  future  production 
aircraft,  and  hence  reduce  the  development  timescales  and  risk  for  such  programmes.  In 
fulfilling  this  aim,  comprehensive  development,  validation  and  certification  activities 
have  been  completed  to  a  depth  that  has  confirmed  the  major  problems  and  identified 
practical  if  not  optimum  solutions. 

The  novelty  of  the  system  is  essentially  the  use  of  digital  computing  therefore  the 
principle  experience  gained  has  been  associated  with  software  design  and  certification 
for  very  high  integrity  applications.  This  is  summarised  in  the  following  paragraphs. 

6.1.  Software  Requirements  Definition 

Analysis  of  the  1300  Change  Requests  raised  during  the  early  phases  of  FRS  development 
shows  nearly  half  were  required  because  of  changes  to  the  specification  or 
misinterpretation  of  the  requirements  documents.  Significant  cost  and  time  savings  can 
therefore  be  achieved  by  ensuring  an  accurate  and  unambiguous  definition  of  requirements 
early  in  the  programme.  Since  some  changes  of  definition  are  inevitable,  particularly 
for  a  toally  new  aircraft  programme,  structuring  and  segregation  of  the  software  to 
minimise  the  rework  necessitated  by  the  more  probable  areas  of  change  also  improves  the 
efficiency  of  producing  the  FRS. 

6.2.  Software  Segregation  and  Visibility 

Visibility  of  the  FRS  structure  and  code  is  a  pre-requisite  to  subsequent  modification 
potential,  analysis  of  problems  found  during  system  testing  and  subsequent  integrity 
audit  of  the  software.  The  production  of  structured,  modular  software  with  stringent 
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procedural,  documentation  and  configuration  control  can  be  tedious  and  is  expensive,  but 
no  other  technique  has  yet  been  established  which  can  enable  adequate  integrity  of  the 
resulting  software  to  be  determined. 

6.3.  Programme  Store  and  Run  Time  Contingency 

Minimising  programme  store  and  run  time  constraints  reduces  the  problems  gf  producing 
the  first  issue  of  a  real  time  software  programme.  Even  greater  benefits  are  found  when 
modifications  are  subsequently  required.  Therefore  to  keep  total  development  costs  to  an 
acceptable  level,  and  also  maintain  visibility  of  the  final  software,  considerable 
attention  must  be  given  to  hardware  capability  and  software  design  and  structure.  Cost 
effective  contingency  allowances  must  be  made  available  within  the  segregated  programme 
store  and  the  segmented  software  run  time  structure  to  allow  future  modification  without 
the  knock  on  effects  of  restructuring  hardware  and/or  software  or  total  re-allocation  of 
the  programme  within  the  store  devices. 

6.4.  Integrity  Audit 

The  Jaguar  Fly-By-Wire  programme  has  developed  integrity  audit  techniques  and  procedures 
which  have  enabled  the  aircraft  to  be  cleared  for  flight  without  having  to  compromise 
any  of  the  original  requirements.  The  success  of  this  aspect  of  the  programme  has  been 
dependent  on  many  factors  including:- 

•  Independent  auditors 

•  Structuring  the  integrity  anaLysis  to  assume  perfect  implementation,  then 
assessing  the  probability  of  defects  in  the  identified  critical  implementation 
features. 

•  Correlation  of  results  from  both  'top  down*  and  'bottom  up'  analyses 

•  Constructive  •  se  of  emulation  and  control  flow  analysis  techniques 

•  Dedicating  Senior  engineering  resources  to  complete  a  thorough  integrity 
appraisal. 

6.5.  Development  Tools 

Tne  task  of  developing  and  validating  high  integrity  digital  systems  can  only  be 
achieved  in  practical  timescales  if  adequate  tools  are  made  available.  Powerful, 
efficient  and  well  proven  software  tools  are  necessary  to  contain  the  task  of  software 
production,  testing  and  configuration  control.  Sophisticated  rig  facilities  are 
essential  to  enable  thorough  testing  of  the  full  system  executing  representative  flight 
tasks  in  real  time.  Reliable  hardware,  with  dependable  BIT,  supported  by  comprehensive 
data  acquisition  and  processing  facilities  enable  extensive  testing  to  be  carried  out  in 
realistic  timescales.  The  hardware  and  software  techniques  developed  by  NAv, 
complemented  by  the  8Ae  developed  rigs,  emulation  and  data  acquisition  systems,  have 
identified  and  assembled  a  powerful  capability  for  developing  future  systems. 


7.  DEVELOPMENTS  FOR  THE  FUTURE 

Plans  are  now  being  considered  for  extending  the  role  of  the  Jaguar  Demonstrator 
aircraft  beyond  the  strakes  flight  test  programme.  However  any  resultant  programme  is 
likely  to  use  the  aircraft  to  investigate  control  techniques  rather  than  concentrate  on 
FCS  development.  In  general,  therefore,  further  software  development  is  expected  to  be 
cost  constrained  to  minimum  changes  within  the  existing  definition,  structure  and 
production  techniques. 

Extensions,  adaptations  and  enhancements  of  these  techniques  are  therefore  being 
associated  with  new  programmes  such  as  P110/ACA.  Building  upon  the  experience 
established  prior  to,  and  during,  the  Jaguar  programme,  the  following  software 
specification,  organisation  and  coding  concepts  are  now  being  evaluated. 

7.1.  Software  Requirements  Definition 

The  software  requirements  definition  can  introduce  problems  in  three  ways  -  errors, 
omissions  and  ambiguities.  Improving  the  methods  of  definition  can  do  nothing  to  prevent 
errors  resulting  from  incorrect  assessment  of  the  aircraft  characteristics  or  the 
control  task,  but  it  should  be  possible  to  reduce  the  remaining  sources  of  problems. 
Most  of  these  are  introduced  at  the  boundaries  between  data  bases.  Transfer  of 
information  from  the  control  law  designer,  to  the  requirements  documentation,  thence  to 
the  detail  software  control  specification  and  eventually  the  code  and  test  processes, 
all  potentially  introduce  translation  errors,  misinterpretations  and  omissions. 
Consideration  has,  therefore,  been  given  to  techniques  which  improve  the  visibility  of 
these  translation  processes  and  provide  scope  for  more  automated  correlation  between  the 
initial  requirements  and  the  final  code.  Writing  the  initial  requirements  document  in 
machine  executable  statements  enables  the  definition  to  be  exercised  against  the 
aircraft  model,  and  subsequently  the  performance  of  the  final  code  can  be  checked 
against  the  same  model.  Correlation  of  the  results  should  then  rapidly  detect  any  errors 
that  have  been  introduced.  Adoption  of  a  more  'top  down'  approach  to  producing  software 
requirements  documents  should  minimise  omissions  within  the  definition  and  should  also 
provide  a  more  ordered  and  perhaps  more  efficient  structure. 
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7.2.  Segregation 

Extension  of  the  software  partitioning  already  practised  can  provide  further  benefits, 
particularly  where  the  FRS  development  is  to  be  carried  out  by  more  than  one 
organisation  e.g.  task  sharing  between  avionics  supplier  and  airframe  company.  As  a  next 
step,  segregation  of  the  software  into  two  or  three  essentially  autonomous  sections  is 
proposed.  These  would  cover  for  example  Executive  and  Data  1/0  (type  A),  Data 
consolidation  and  system  monitoring  (type  B)  and  Control  Law  tasks  (type  C).  Each  would 
be  allocated  segments  of  the  programme  store  and  frame  run  time,  with  communication  via 
nominated  locations  within  the  scratchpad.  All  work  space  locations  would  be  read/write 
protected  to  minimise  illegal  data  transfer  in  the  event  of  hardware  faults  or  software 
design  errors.  With  this  structure  the  software  can  be  developed  by  separate  teams  with 
reduced  short  term  interaction.  Since  the  type  A,  and  to  a  slightly  lesser  extent  the 
type  B,  software  will  change  very  little  for  a  given  system,  the  control  law  changes  can 
be  contained  within  the  type  C  software  (perhaps  3QX  of  the  programme)  with  very  high 
confidence  that  the  integrity  of  the  remainder  of  the  programme  has  not  been 
compromised. 

7.3.  Task  Orientated  Programme  Language 

The  standard  macro  library  used  for  the  Jaguar  FBW  software  is  being  extended  to  cover 
the  majority  of  the  tasks  required  by  the  control  law  designer.  By  using  macro  names  ana 
parameters  which  are  familiar  to  the  control  law  designer,  incorporating  scaling 
functions,  and  providing  data  fetch  and  store  facilities  a  task  orientated  F l i g h  t 
Con t  r  o l  J^a  nguage  (FLICOL)  has  been  created.  Figure  14  shows  an  example  of  a  control  law 
path  written  in  this  language  demonstrating  the  visibility  that  can  be  achieved. 


Kr:=0  2 


KX1_0  6 
K0Day  =0  05 
GET  r 
GAIN  (Kr) 

00  WASHOUT  <3  33) 

SCALE  (5  0) 

PUT  HOLD  I 
GET  XI 
GAIN(Kxi) 

SUM  (HOLD  1) 

PUT  HOLD  2 
GET  ay 
GAIN  (KDOay) 

F11  WASHOUT  (20  0) 

SCALE  (2  0) 

SUM  (HOLO  2) 

F12  LAG)  (0  04) 

F13  SCHE01  (150  0,400  0,1  0,0  1,650  0,V) 
PUT  ZETA 


Figure  14  Example  of  Flight  Control  Language  (FLICOL)  Statements 


The  support  tools  for  this  language  are  based  on  those  presently  developed  and  well 
proven,  providing  a  relatively  simple  translation  to  the  selected  instruction  set  of  the 
target  processor.  These  tools  can  include  engineering  calculations  to  relieve  the 
programmer  of  tasks  associated  with  defining  filters,  voter  monitors,  rate  limits  etc. 
which  are  functions  of  iteration  rates. 

FLICOL  can  also  be  developed  as  a  systems  simulation  language.  This  could  lead  to  a 
situation  where  the  control  laws  developed  on  the  simulator  can  be  directly  translated 
to  the  programme  for  the  target  processor  without  the  need  for  source  code  changes  and 
thus  reduces  the  possibility  of  introducing  errors  or  misinterpretations. 

7.4.  High  Order  Languages 

The  macro  assembler  language  is  considered  a  highly  visible,  efficient  and  safe  approach 
to  producing  high  integrity  software,  particularly  for  special  purpose  processors  with 
instruction  sets  optimised  for  flight  control  applications. 
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The  use  of  general  purpose  microprocessors,  high  order  languages  and  compilers  for  high 
integrity  applications  has  caused  concern  because  of  the  lack  of  visibility  of  the 
device  structure,  microprogram  and  compiler  'optimisation1  routines.  With  the 
development  of  task  orientated  microprocessors  such  as  those  implementing  M1L-ST D-l 750A, 
and  corresponding  languages  with  more  formal  verification  such  as  JOVIAL  and  perhaps  ADA 
these  limitations  are  being  minimised.  Future  use  of  these,  in  applications  where 
st anda rd i sa t i on  of  hardware  and  software  production  methods  are  very  significant,  is 
being  pursued. 
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L' INTERFACE  HOMME  -  MACHINE 

dans  les  avions  comn.e  rr  i  au  x 
Jo  la  nouvelle  o  n  o  rat  ion 
par 

Robert  C  a  1  a n 

P  i  1  o  t  o  d  1  lissa  is  ,  Centre  d  '  K  s  s  a  i  s  on  V  o  1 
91220  -  Bretigny-sur-Orge,  France 


INTRODUCTION 


Lf  but.  du  present  expose  rst  de  presenter,  apron  >.i  t.ief 
rappel  liir*  tori  quo  de  re  qu'a  ete  1' in  ter  face  horn  me  -mac  h  i  nr  depnis  les  tend  dr"  huts 
de  1' aviation,  les  diverse s  tendances  de  ret  interface  pour  la  del  file  re  derrmic  u  u 
s iec 1 e  . 

l'n  simple  coup  d  '  oe  i  1  ,  me  me  nori  avert  i,  ne  peut  pur  <  oi.nl  atei 
line  profonde  evolution  dans  le  stvle  des  rapport?;  nitre  les  aeronefs  et  lour.;  emipam 
Co  quo  1  *  o  n  v  o  i  t  peut -et  re  nioins,  c'liit  (pie  eel  to  evolution  a  precede  par  tone];.. 

C'est  un  bond  spec  t  ncu  1  a  i  r  e  quo  1*  interfate  t ,  nr-ru  -  n  i  '  i  i  *  i;t 
en  train  de  frnnehir  au  milieu  des  annees  quat  rn  vinqts.  (In  se  propose  au  (  our  s  de  ret 
expose,  vol  out  a  i  rrmei.  t  suecinct,  de  nu>t  t  re  on  evidence  i  e  s  cu r net e r i s t i ques  \  r  a  f  o  r  dr  s 
de  re  bond. 


HISTORIQUE  DE  L 'INTERFACE  HOMME  -  MACHINE 


1.1.  L'INTERFACE  DES  PREMIERS  TEMPS 

Apres  uric  phase  fugitive  pendant  laquelle  l’homr.e  a  v  o  1 1  n 
se  servant  de  roc  souls  sons  vur,  oc/Te,  senna  t  i  on;;  nuaru  1  ai  re:;  •  ,  non  sain  diff  icujti’ 
car  cos  sens  n*  eta  ion  t  pas  adapter,  a  re  nouvel  cm  j  r  onneni  n  t  ,  uii  a  imagine  de  ti.t.n.ii- 
les  paramfctres  du  vol  en  valours  miner  iquos  les  imnqeant  de  fa^on  i  n  t  r  1  1  i  :  i  !  1  r  . 

(os  pri’micrrs  valours  mime  r  iquos  eta  ion  t  e  1  a  b  o  r  e  e  s  en  do- 

positions  de  1  '  avion  directement  ae  re?;:;  1 h  1  es  a  1  '  oe  i  ]  du  pilule. 

le  prc*r..  ier  interface'  homire-narh  i  no  dtait  rnnstitue  par 

exemple  : 

-  d  1  une  colonne  de  liqui do  s  e  dep  Infant  sous  1  ’  at  t  ion  de  la 

depression  d'lin  tube  Venturi,  et  dormant  une  idee  dr'  la  Mv  it  esse"  uracr  a  ui.e  loi 

approcheo  de  M.  Hf  R\()UI  l.  I  ; 

-  de  rep6roc  our  la  structure  au  droit  drs  parties  not?  ill's; 

-  de  "jauururs"  a  lecture  direr  tr',  par  hauteur  du  rarburam 
dans  des  tubes  transparent';  common i quant  avec  les  reservoirs. 

1.2.  LES  CHAIHES  DE  ME  SURE  INDIVIDUEllES 

Ires  vite,  il  est  nppnru  quo  les  par  a  metre's  doit  la  van  at  im 
permettait  au  pi  lot  r*  de  qorer  au  mirux  son  vol  et  la  machine  variaient  dam;  de.; 
milieux  eloiqnes  tin  poste  de  pilotaqc  lui-m6mc:  pression  d’huilo  dans  les  motoui:  , 
quant i to  de  cartuirant  dans  les  reservoirs  d'nile,  position  des  compensa t eu r s  en  e\tr<- 
m  i  t  e  d e  voi  birr ,  etc  .... 

II  a  fallu  concevoi  r  les  promises  "chat  nos  de  me  sure",  qui 
se  sor.t  vite  qi*ni* r a  1  i see s  cur  les,  avions,  scion  It'  schema  suivant  : 


flans  lrv  cockpit 


cap t  en r  "in  situ " 


1  i  1 1  nr  de  transmission 


inst r  ume  n  t 


I  p  dr^'-e  1  oppement  colncidant  aver  une  nu'illeure  malt  rise  de 
i'bnerqir  f*  I  or  t  r  i  quo  ,  t  rtNs  vite  on  a  traduit  le  parametro  a  mesurer  en  signal  rlec- 


trii|ue  signal  armloqiquo  variable  en  ini  ensile,  t  en 
eheminer  jusqu'nu  cockpit  rlnns  un  f  il  rMectriqur  ou ' 
1  *  a v  ion. 


ion  on  phono  1  facile'  a  faire 
1  t  ait  nise  de  ramie  r  dans 


Un  a  vu  apparaltrc  de  multiples  chair  ms  de  mo  sure  du  typo  : 


captour  do  position 
(montaijo  or)  pout  do  Wheatstone) 


f  il 


indicate ur  d e  position 
au  tableau  de  bord 


captour 
(recepteur  ADF 


radio electriquc 
a  cadre  assorvi) 


f  il 


♦ 


in dicat  our  de  gi  semen t 
(recopie  de  position  du  cadre 


Avec,  en  variant e,  des  transmissions  de  press  ion  au  t ravers 
d 1 un  tube  cheminant  direct ement  d ' un  captour  de  prrssion  jusqu'au  tableau  de  bord. 


1,3.  LA  GENERATION  DES  CENTRALES 


Dans  lo  courant  des  ounces  soixante,  la  masse  des  1  r;  f  o  r  n.a  t  i  ons 
t  ratt.ee  dans  le  cockpit  dovenait  extrdmemerit  important^,  et  l'on  avait  affaire  a  des 
p.iram&treo  qu'il  fa  11  ait  a  la  fois  diffuser  en  different s  endroits,  et  utiliser  sous 
I  or  me  de  facteurr  correct  if s  pour  1* elaboration  d'autres  par  a metres. 

Ainsi  la  pression  statique,  envoyce  dans  des  instruments 
primaires  . al t imfet res )  ,  servant  h  elaborrr  d'autres  paramfetres  la  "vitesse  andmome- 
trique"  dans  les  anpmomttres),  et  int  erven  ant  dans  des  aut  orr.at  ismes  comrne  les  regula- 
tours  de  moteurs  on  les  syst&mes  de  pressui isat ion . 

hour  eviter  de  multiplier  a  l'infini  les  liqnes  de  transmission 
dont  la  lonqueur  finissait  par  se  mesurer  en  dizaines  de  kilometres  sur  un  avion  de 
ligne),  on  en  est  arrive  concevoir  des  "centrales":  l'av ion-type  de  la  fin  de  cette 
decenn ie  comport  a  it  par  oxomplo  : 

-  one  cent  rale  anemome  t  r  i  que 

-  une  cent  rale  gyroscopique 

-  une  central e  do  cap 

-  une  cent  rale  de  navigation. 

Chaque  "cent  rale"  etait  un  calculateur  analog ique  qui  : 

-  d  1  une  part  recevait  direct  ement  de  cap  tours  e  le  merit  a  i  res 
des  parnmfct res  de  base  "bruts"  ipar  exempli?  pressions  statique  et  tutalo,  temperature 
rj 1  impact  pour  une  rentrale  anomometrique); 

-  (1 '  autre  part  distribuait  vers  divers  "ul  i  1  i  sa  tours” 
instruments  du  tableau  bord  on  syst ernes  divers'  des  paramelres  elabores  'tempera¬ 
ture  statique,  vitoss  propro,  nombre  de  Mach). 

1,4.  LA  NOUVELLE  GENERATION 


Le  milieu  des  anno os  soi\nnte-dix  a  vu  1 'apparition  de 
prnqrcr.  toot  r  :  gues  divers  et  decisifs  : 

-  des  calculatours  numrriques  a  fniblcs  masse  et  encombrement , 
a  grande  capacity  de  calcul  -permettant  le  mlnil  en  temps  reel  de  paramo! res  multiples, 
complexes  et  a  variation  rapi  do),  et  a  grande  capacity  do  memo  .ire  (permettant  le  stocka- 
qe  de  dnnridcs  lines  au  domaine  de  vol  ou  a  l'niro  geographique  de  travail); 

-  des  tubes  eathodiques  couleurs  a  haute  definition  et  grande 
fiabilite  technique  dito  ” shadow -mask" ) ; 


t  ■  i ant s . 


des  ayst  ernes  de  col  1  irrmt  inn  luminrux,  clnirs  et  peu  encom- 


f'es  prog  res  ont  perm  is  une  n  ouve  lie  conception  de  1’  int  erf  ace 
humme -marh i no .  I  'avion  des  nnndes  quatre  vinqts  prut  dt  re  present e  sous  la  forme 
s  r  t)  d  mat  i  q  u  e  s  u  i  v  a  n  I  e  : 

-  au  centre  de  1' avion,  lr  rncur  de  tons  les  s>st ernes,  un  cal- 
nilnt  rnr  numdrigue  central  gnas  l  -  i  nvu  1  nr  r  nb  1  r  -'haute  r  edondanee  dans  les  ralculs, 
protection  tot  ale  coot  re  les  perturbations  o\ t dr i euro s ) ,  a  capncitd  dc  calcul  rt  de 
mdmiirrs  et  a  vitesse  de  t  ravail  permettant  la  qest  ion  rn  tempi'  reel  de  tons  les? 
syst  ernes  et  de  1'erisemhle  rlu  vol; 


-  en  nmont  ,  des  rapt  ours  divers  et  varies  places  auv  endroits 
nu  cto  i  vent  dtre  fails  le:;  mesurer,  brutes,  avec  conversion  ana  1  oo  i  qur  -  num(;  r  i  quo  des 
parametrrs  sur  place,  et  transfer!  sous  forme  numdrigue  (  i na  1 1 d r ah  1 e  )  au  calculateur 
r  e  ri  1  r  a  1  : 
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-  en  aval,  des  appa re i 1 1  aye s  divers,  tubes  cathodiques  de 
planche  de  bord  essent ie 1 lement ,  eol 1 imat eu rs  de  pilotage,  instruments  isol£s,  sous- 
ensembles  techniques  comme  les  commandes  de  vol  £lectriques; 

-  pour  le  dialogue  direct  enf in  entre  l'^quipage  et  le  cal- 
culateur  (dans  les  deux  sens,  ordres  et  questions,  introduction  de  donn£es  dans  le 
sens  homme-machine  et  r^ponses  dans  le  sens  mach i ne-homme )  des  unites  de  dialogues 
dites  "C.D.U."  (command/display  units)  composes  d'un  clavier  de  touches  de  fonction 
et  a lphanum^r iques  et  d'un  tube  cathodique  b  lecture  alpha num Clique. 

Bien  entendu,  le  schema  simplifie  ci-dessus  n’est  pas  apparu 
qlobalement  dans  son  ensemble.  Les  realisations  du  ddbut  des  anri^es  qua t re- v i ng t s  sont 
partielles:  les  tubes  cathodiques  de  planche  de  bord  sont  doubles  d ' i ns t rumen t s  indi- 
viduels  "de  secours"  ,  les  commandes  £lectriques  sont  doubl£es  de  "secours"  m^caniques 
(servo-tabs) . 

Mais  la  tendance,  b  1* horizon  quatre-vingt-dix,  est  celle 

ci-dessus  d  y  c  r  i  t  e  . 

Dans  la  suite  de  l'exposd  sont  abordds  tour  b  tour  les 
diffdrents  composants  de  l’interface  de  la  fin  du  si&cle.  On  y  montrera  pour  chacun 
l'dtat  des  ytudes,  les  tendances  et  les  realisations. 


2.  LES  TUBES  CATHODIQUES  DE  PILOTAGE 


2.1.  TECHNIQUE  ET  PREMIERES  REALISATIONS. 


L'idde  de  base  a y a n t  conduit  b  1 1  apparition  des  premiers 
tubes  cathodiques  de  pilotage  est  qu'il  est  b  la  fois  plus  fiable  et  plus  souple  de 
travailler  sur  de  1' electro nique  que  sur  du  mecanique. 

On  a  done  imaqine  de  remplacer  les  instruments  dlectro- 
meranlques  de  pilotage  par  des  tubes  cathodiques  b  balayaqe  (sortes  de  petits  postes 
de  television  installs  sur  la  planche  de  bord). 

Pour  que  ceci  soit  realisable,  il  a  failu  sur  le  plan  techni¬ 
que  resoudre  un  certain  nombre  de  problfcmes,  qu'on  cite  pour  memoire  : 

-  obtenir  une  tr&s  grande  finesse  de  dessin  (par  augmentation 
du  nombre  de  liqnes  de  balayaqe); 

-  pouvoir  jouer  sur  de  nombreuses  couleurs  bien  ind i v i dua 1 i sees 
(on  arrive  aujourd'hui  b  une  dizaine  de  couleurs)  conservant  leur  contraste  relatif  en 
ras  de  panne  d'un  des  canons  monochromat iques  de  base; 

-  avoir  une  luminosity  apparente  const  ante,  i n depen da  rite  des 
conditions  amhiantes  (que  le  tube  soit  dans  1' ombre  ou  au  soleil); 

-  avoir  une  cadence  de  renouve 1 1 ement  de  1 ' image  suf f isamment 
e levee  pour  que  les  parties  mobiles  hvoluent  de  fag  on  lisible  pour  l'oeil  (ce  qui  est 
obtenu  par  des  frequences  de  r a f r a  1 ch i ssemen t  de  30  Hertz  ou  plus). 

La  technique  etant  au  point,  on  a  dans  un  premier  temps 
recopie  purement  et  simplement  les  instruments  de  vol  principaux  (ADI  ou  "attitude 
director  indicator"  et  HS1  ou  "horizontal  situation  indicator"). 

f'est  ce  qui  a  etc  fait  par  exemple  sur  1 1  ADI  cathodique  des 
(ADI/HSI  (tubes  cathodiques  de  pilotage)  des  0.737  et  tt.  767  (avec  maquette,  horizon, 
directeur  de  vol,  "fast -slow" ,  hearts  lor  et  glide)  ou  sur  le  MSI  des  tflS  (tubes 
cathodiques  de  pilotage)  de  l'A.310  ,  en  mo dp  "rose"  (rose  des  caps,  rep6re  ha ut  de 
cap,  y c a r t  lateral  VUR  ou  l  or  ,  aiguilles  ADf  )  . 


2.2.  CONCEPTION  D’ UNE  MOUVELLE  SYMB0L0GIE 


Les  immenses  poos ib  i  1  i  1 <5s  offertes  par  les  tubes  cathodiques 
orit  perm  is  d'envi  anger  des  symbologies  enticement  "rppenstfes",  qui  aura  lent  £t£ 
impossibles  sur  des  instruments  y 1 ec t r omyran i ques  rlassiques. 

ta  tendance  est  celle  d '  line  concentration  des  informations 
sur  un  tube  unique.  Ainsi  : 


-  sur  l'ADI  cathodique  des  EFIS  de  l'A.310,  on  a  regroup^, 
autour  de  l'horizon  classique  et  de  son  directeur  de  vol,  b  gauche  un  andmomfetre 
£volu£  (plus  "riche"  qu’un  an^momfetre  classique),  5  droite  une  information  (sommaire) 
d'^cart  d'altitude; 

-  sur  les  HSI  cathodiques  des  EADI/HSI  des  B.757/B.767  et  des 
EFIS  de  l'A.310  on  a  fait  apparaitre  des  "cartes"  (avec  trac£  de  l'itindraire  pr£vu, 
dessin  de  circuits  d'attente,  localisation  d'aides  radio  ou  d ' aerodromes )  avec,  en  sur- 
impression,  des  informations  ( synthet iques )  issues  du  radar  md t £oro 1 og i que . 

Mais  la  concentration  n'est  pas  le  seul  r^sultat  auquel  on 
a  pu  arriver  grAce  aux  tubes  cathodiques  de  pilotage.  On  a  pu  faire  apparaitre  des 
informations  absolument  inedites  dont  on  cite  ci-dessous  quelques-unes  parmi  les  plus 
int dressantes  : 

-  anemom£tre  lin^aire  (EFIS  A. 310)  gquipe  des  limites  de 
domaine  actuelles  rbelles  dlabordes  par  le  calculateur  central,  haute  (fonction  de  la 
configuration  actuelle)  et  basse  (fonction  de  l'incidence  actuelle)  et  d'une  "preci¬ 
sion"  de  vitesse  b  10  secondes  (eiaboree  b  partir  de  l'energie  totale  actuelle); 

-  horizon  artificiel  (EFIS  A. 310)  b  all&gement  de  symbologie 
alertant  b  l’approche  d'attitudes  anormales; 

-  acces  plus  direct  b  la  trajectoire  par  representation  sur 
l'ADI  (FFIS  A. 310)  d ' un  " vec t eur- v i t esse  sol"  permettant  de  suivre  en  approche,  en 
l'absence  de  moyens  radioelect r iques  performants,  une  pente  sol  et  une  route  vraie 
constantes,  independamment  des  conditions  exterieures  (variations  de  vent  en  parti- 
c  u  1  i  e  r  ) ; 

-  indicateur  de  derapage  electronique  couple  b  l'indicateur 
d ' inc 1 ina i son  latdrale  (EFIS  A. 310). 

-  indicateurs  t ridimensionnels  (&  l'etude)  d'approche  MLS 
(etudes  du  systeme  "VEGA"  et  associees  au  Centre  d'Essais  en  Vol  de  Bretigny,  Etudes 
de  la  NASA  b  Ames). 


2.3.  LE  T0UT-CATH0DIQUE  DE  PLANCHE  DE  BORD 

Certains  concepteurs  v/ont  plus  loin  et,  uuivant  en  cela 
certains  projets  avancis  (parmi  lesquels  on  peut  citer  le  JAS  su^dois  de  SAAB),  envi- 
sagent  de  recouvrir  la  totality  de  la  planche  de  bord  par  des  ccrans  de  t£l£vision  h 
grande  surface  portant  la  totality  des  informations  n^cessaires  au  pilotage. 

On  peut  citer  parmi  les  btudes  en  cours  pour  1' aviation 
commerciale  les  tubes  cathodiques  intdqrfs  &  grande  surface  de  Smiths,  qui  volent 
depuis  plus  d'un  an  sur  un  HAT. Ill  du  HAT  en  Grande-f)  retagne . 

Le  viraqe  vers  de  tels  tableaux  de  bord  n'est  pas  definitive- 
ment  pris,  mais  les  orientations  prises  par  les  secteurs  c 1  a ss i quemen t  de  pointe  en 
ce  domaine  (on  peut  ici  citer  la  navette  spatiale)  laissent  h  penser  que  l'avenir  des 
tubes  cathodiques  de  planche  de  bord  reste  entier  dans  l'aviation  commerciale. 

2.4.  LES  PR0BLEMES  POSES  PAR  LES  TUBES  CATHODIQUES  DE  PILOTAGE. 

Les  tubes  cathodiques  de  pilotage  sont  d  (5  j  &  en  service  sur  de 
avions  commercially  certifies  de  la  "grande"  aviation  (B.  757/767  ,  A. 310)  comme  de 
l'aviation  d'affaires. 

Pour t ant,  to us  les  problfcmes  ne  sont  pas  r^solus  pour  autant, 
et  les  services  officiels  des  diffdrents  pays  concern es  ont  b  se  pe richer  d* urge nee  sur 
certains  probldmes  essentiels  qu'il  conviendra  de  rbgler  rapidement  sous  peine  d'abou- 
tir  b  des  situations  in extricables  : 

-  mise  au  point  d'une  re5g 1 emen t a t i on  internat ionale  (FAR  ou 
JAR)  fixant  les  regies  de  conception  et  de  realisation  des  tubes  de  pilotage,  qui  n'en 
est  encore  qu'au  stade  des  etudes  pr^paratoires; 

-  accord  sur  une  semi-standardisation  sur  les  symboles  (en 
part  icul  ier  pour  Ins  paramM  res  nouvellement  prc*sent£s)  voire  sur  les  couleurs  et 
d’autres  principes  de  figuration  (symboles  momentan^ment  r  ep  r(5sen  t  (5s  en  tiret£s,  ou 
clignotants); 

-  accord  sur  une  nouvelle  conception  globale  de  la  planche  de 
bord  -  c ' est -?»-di re  sur  les  positions  relatives  des  nouveaux  symboles  sur  les  nouveaux 
tubes  de  pilotage,  et  de  ces  tubes  de  pilotage  pux-m&mes,  comme  on  1’avait  fait  pour 
les  instruments  classigues  ("T"  de  planche  de  bord  pour  les  quatre  instruments  de 
base  ) . 
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3.  LES  TUBES  CATHODIQUES  DE  GESTION  DE  SYSTEMES 


3.1.  TUBES  CATHODIQUES  DE  CONTROLE  MOTEURS 


De  m£me  qu'il  a  £ty  vite  tentant  de  remplacer  des  instruments 
de  vol  elect ro-mdcaniques  par  leur  recopie  sur  des  tubes  cathodiques  couleurs,  de  m£me 
on  a  rapidement  envisage,  avec  l'avdnement  de  ces  tubes  perfect ionn^s ,  de  remplacer  les 
instruments  de  contrdle  des  moteurs  par  des  tubes  cathodiques  les  recopiant. 

C'est  ce  qui  a  £ty  fait  en  version  de  base  sur  les  B. 757/767, 
ou  des  tubes  cathodiques,  installs  au  centre  de  la  pla riche  de  bord,  entre  les  deux 
pilotes,  reproduisent  les  instruments  classiques  de  contrfile  des  moteurs. 

fn  fait,  ces  tubes  apporterit  sur  les  instruments  yiectro- 
m^caniques  plusieurs  avantages  sur  le  plan  de  1'  interface  : 

-  1  'aspect  analogique  est  conserve  en  s'alldgeant 

(une  "aiguille"  se  dyplace  devant  des  secteurs  color^s  classiques  ver t -ambre-rouqe , 
dypouiliys  de  graduations  et  de  chiffres); 

-  une  seule  valeur  num^rique  apparait,  la  valeur  actuelle, 
qui  a  elle-m£me  une  couleur  codye  (vert  en  £chelle  d * u t i 1 i sa t i on  normale,  ambre  en 
zone  marginale  et  rouge  en  secteur  dangereux),  avec  d'autres  avatars  possibles  (aug¬ 
mentation  de  taille,  c 1 ignot ement  )  . 

II  reste  que  ce  type  d'information  sur  u n  tube  cathodique, 
en  amont  duquel  on  dispose  de  calculateurs  performants,  reste  trfes  en-de^  des 
possibilitds  actuelles. 


On  donne  ci-dessous  deux  exemples  de  tubes  cathodiques  asso- 
ci^s  h  des  programmes  de  gestion  de  syst&mes  : 

-  les  tubes  descriptifs  de  systfcmes 

-  les  tubes  de  quidage  d'action  (tubes  de  presentation  de 
"do-lists"  ou  de  "check- 1 ists"  )  . 


3.2.  TUBES  DESCRIPTIFS  DE  SVSTEMES 


Un  des  deu\  tubes  du  systfcme  de  gestion  des  syst&mes  de 
l'A.310  (ECAM),  congu  et  rdalisy  par  TH0M50N-CSF  pr£sente  en  permanence  un  des  circuits 
essentiels  de  1' avion  (par  exemple:  circuits  freinage,  hydraulique,  yiectrique, 
carburant ,  etc 


fhaque  circuit  est  reprdsenty  de  fa^on  assez  simplifi£e, 
mais  de  f ayon  h  faire  apparaltre  les  "lignes"  essent ie 1  les ,  avec  un  code  couleurs 
(les  circuits  en  service,  sous  tension  ou  sous  pression,  ytant  repr£sent£s  d'une 
couleur  diff^rente  de  celle  des  circuits  isol£s),  les  vannes  (ou  contacteurs,  robinets 
disjoncteurs,  etc  ...)  avec  les  representations  ouvert/fermy  et  certaines  valeurs 
numeriques  (et  parfois  aussi  analogiques)  en  certains  points  cl£s. 

Un  seul  coup  d'oeil  sur  chaque  circuit  permet  de  d^celer 
les  defaillances  yventuelles  qui  le  pynalisent,  et  on  peut  rapidement  y  lire  le 
resultat  d'operations  qu'on  y  fait  par  ailleurs  (la  fermeture  volontaire  d’une  vanne 
y  est  "vue"  i ns t an t a n^me n t ,  avec  l'isolement  des  parties  de  circuit  qu'elle  provoque). 

Pour  chaque  circuit,  une  figuration  unique  sur  le  tube 
cathodique  permet  de  remplacer  a van t ageusement  la  consultation  de  nombreux  instruments 
classiques  . 


Comme  dans  ce  type  de  tube  un  seul  circuit  peut  dtre  repre¬ 
sent^  h  la  fois,  il  importe  de  dyfinir  une  logique  d'apparition  des  circuits  sur  le 
tube  unique.  Cette  logique,  pour  les  ECAM  de  l'A.310  est  la  suivante  : 

-  en  vol  normal,  le  circuit  pr£sent6  est  celui  qui  est  le 
mieux  adapts  &  la  phase  du  vol  en  cours  (circuits  moteurs  h  la  mise  en  route,  circuit 
freinage  au  roulaqe,  circuit  de  pressur isat i on  - c 1 ima t i sa t i on  en  croisi^re); 

-  l'6quipaqe  conserve  k  chaque  instant  la  possibility  d'appe- 
ler  le  circuit  qu'il  desire  con suiter; 

-  en  cas  de  panne  sur  un  circuit,  le  circuit  concern^  est 
pr^senty  en  priority  (avec  une  prysentation  syquentielle  basye  sur  les  urgences  respee- 
tives  en  cas  de  panne  multiple). 
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3.5,  TUBES  "DO-LIST"  OU  "CHECK-LIST" 


Un  tube  cathodique  subordonn^  au  calculateur  (ou  au  programme) 
de  gestion  des  syst£mes  peut  §tre  r£serv£  5  la  presentation  d'une  liste  d'op^rations  h 
effectuer  ("do-list”)  ou  d  contrdler  ("check-list")  par  1 'Equipage. 

La  presentation  de  telles  listes  sur  tube  cathodique  presente 
de  nombreux  avantages  par  rapport  aux  check  ou  do-lists  papier  : 

-  elles  sont  appeiees  a u t oma t i quemen t  en  fonction  de  la  phase 
du  vol  en  cours  (en  conditions  normales)  ou  de  la  panne  (en  conditions  anormales)  - 

avec  enchalnement  relatif  des  deux  dans  les  cas  critiques  (feu  au  decollage  par  exemple); 

-  le  yraphisme  (taille  des  lettres  ,  souligne)  ou  la  couleur 
peuvent  attirer  1 ' attention  sur  les  actions  les  plus  urqentes; 

-  un  code  couleur  particulier  peut  permettre  le  contrfile  par 

le  systkme  de  la  bonne  execution  des  operations  prescrites  par  l'equipage:  si  la  "do-list" 
prevoit  sur  une  ligne  l'ouverture  d'un  robinet  d' intercommunication,  la  couleur  de  la 
ligne  ne  changera  (pour  prendre  la  couleur  "operation  effectuee")  que  lorsque  le  calcu¬ 
lateur  de  gestion  aura  effect  ivemerit  rei;u  d'un  capteur  1 ' i nf orma t i on  que  le  robinet 
a  bien  ete  ouvert.  D 1 ou  une  securite  accrue. 


4.  LES  SYSTEMES  DE  GESTION  DU  VOL 


4.1.  LE  PROBLEME  DE  LA  GESTION  DU  VOL 


G^rer  un  vol  commercial  de  fagon  efficace,  c'est  le  conduire 
d'un  point  5  un  autre  dans  les  meilleures  conditions  de  s#curit£  et  d'^conomie. 

Dans  la  pratique,  cela  implique  b  la  fois  la  qestion  optimi¬ 
se  d'une  trajectoire  et  celle  du  carburant,  avec  les  interferences  permanentes  qu'il 
y  a  entre  cex  deux  gestions. 

Dans  les  premiers  temps  de  I'aviation  commerciale,  l'equipa¬ 
ge  avait  b  assurer  la  totalite  du  travail  de  qestion.  Pour  prendre  un  exemple 
seulement  dans  la  gestion  de  la  trajectoire,  il  ne  disposait  que  des  valeurs  brutes  de 
parambtres  isoies  (cap  maqnetiqur,  vitesse  a nemome t r i que ,  relbvements  r ad i oe 1 ec t r i ques ) , 
b  partir  desquels  il  devait  determiner  c on t i nue 1 1 emen t  sa  position,  et  definir  les 
corrections  propres  b  le  rapprocher  de  sa  trajectoirp  ideale. 

Plus  tard,  des  calculateurs  analoqiques  aux  performances 
limitees  ont  permis  d'alieger  son  travail  en  calculant  des  parambtres  plus  eiabores 
(vitesses  propre  et  sol,  route  vraie,  position  radioelect rique  en  rad  i  a  1 /d i s t ance  )  . 

L'avbnemeut  des  calculateurs  numeriques  b  grande  capacite  de 
calcul  et  de  memoire  a  permis,  db  s  le  debut  des  ann^es  soixante-dix  de  resoudre  le 
problbrne  de  la  qestion  de  la  trajectoire  en  plan  (quidaqe  automatique  de  l'avioi,  sur 
une  trajectoire  p r e de t erm i nbe  5  deux  dimensions). 

L 'evolution  rapide  des  performances  de  ces  calculateurs  a 
permis  d'envisager  la  qestion  de  la  trajectoire  b  trois  dimensions  (profil  de  vol 
vertical  en  plus),  puis  quatre  dimensions  (avec  la  variable  temps1,  et  d'y  integrer 
enfin  la  gestion  optimisee  du  carburant. 

Ces  differents  systbmes  de  qestion  du  vol  sont  abordes 

tour  b  tour  ci-aprbs. 


4.2.  LES  SYSTEMES  DE  NAVIGATION  DE  ZONE 

Les  premiers  systfcmes  de  qestion  du  vol  a  avoir  (He4  opeHa- 
tionnels  ont  <H£  les  syst6mes  de  qestion  de  la  navigation, 

Un  bon  exemple  en  est  1 1 "Areanav"  de  Pol  1  ins  ,  propose4  en 
option  sur  le  DP.  10  dfcs  1970.  le  principe  en  est  le  suivant  : 

-  un  calculateur  central  dispose  en  memoire  de  toutes  les 
informations  de  navigation  et  de  circulation  aeHienne  concernant  la  region  convert e 
par  les  vols  de  la  Compagnie; 


ik 
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-  ll  di't  i-rniirii>  h  chaque  instant  la  position  de  1‘avion,  a 
partii  d  1  une  pus  1 1  i  m  "rst  lmre"  nmyenne  des  positions  do  trois  centrales  inertielles) 
et  dt*  rer  a  1  ages  i  «n]  i  or  li*ct  i  i  (|uc!;  soi  (Jos  llJI'/l’MI  qu  1  i  1  affichc  lui-mdme  parmi  les 
mieux  approprirs  grAc  c  a  mu1  f  one  t  ion  d  1 1  ♦*  "auto-tune  ”); 

-  lJ  guide  d  ire  dement  1' avion  (au  tracers  du  pilote  automa- 
t  i  q  u  e  )  sur  la  trajectoire  (Jij  vol,  p  r  e  do  t  e  r  m  i  nee  et  affichde  par  1* equipage  avant  le 
depart  ; 

-  ll  fournit  a  1 'equipage  tons  les  rense  i  qnemen  t  s  de  naviga¬ 
tion  annexes  quo  celui-ei  pent  desirer  (distances,  heures  de  survul:  au  travers  d'une 
unite*  de  dialogue  "f.P.ll.")  classigue. 


4.3.  LES  SYSTEMES  DE  GESTION  DE  PERFORMANCES 


le  premier  "choc  pet  roller"  de  J <J  7  3  tftant  coritemporain  de 
l'essor  des  caloulateurs  numoriques  embarqurs,  de  numb  reuses  sue  it' trs  sc  sont  mi  sea  a 
etudier  des  systomes  de  (jest  ion  de  performances  ion  "P.n.S,",  performance  management 
systems) . 


-  so  it  en  rattrnpaqo  r.ur  des  avion;;  dejn  en  service 

(par  exemple  l  ear-5  iegler  pour  les  0.727/737  ,  MOL  I \G-()l  Iff)  pour  le  H.747,  Sf  L \A  pour 

1' A. 3001; 

-  soit  un  systeme  etc  base  pour  des  avions  nouveaux  de  clause 
i nt ermrd  i  a i r e  (les  avions  nouveaux  de  "premier  niveau"  ayarit  ete  direct ement  benef  i- 
eiaires  des  "1. 1-1.5."  etudies  plus  loin). 

Ces  systbmes  nupposent  resolu  le  probleme  de  la  trajectoire 
en  plan  et  calculent ,  h  partir  des  informations  de  masse  avion,  performances  poten- 
tielles  des  moteurs  et  parametres  extdricurs  : 

-  le  rarburant  minimal  a  emborquer  avant  le  ddcollaqc; 

-  le  profjl  vertical  ideal  de  vol  (montre,  altitude  de 
croisiere,  point  de  debut  de  descent e). 

Per,  sy at  femes  pen  vent  en  general  £tre  couples  au  pi  lot  e 
automat  i  gee  et  nux  aut  .  omane  t  t  es  ,  et  gerer  d  i  rer  t  omen  t  la  trajectoire  dans  le  plan 
vert  i  c  a  1  . 


I  Is  ont  leur  interface  avee  1’ Equipage  a;;surc  par  un  C.D.U. 
particulier,  dont  les  touches  de  fonction  et  les  pages  sont  adoptees  aux  forictions 
par t i cu  1  ifercs  du  systeme. 


4,4.  LES  SYSTEMES  COMPLETS  DE  GESTION  DU  VOL 


les  p  r  em  i  e  r  s 
leur  bord  un 
le  \  .n.r>  .  de 


on  t  etc 
s y  s t  feme 
GPf  PPV 


L  r  s  a  v  l  o n s  r  om m  e  r  c  i  a  u  x  <  1  e 
cert  it  ifes  au  debut  de  1\>P  3,  or.t 
de  (jest  ion  globule  du  vol  :"f.f1 
pour  1  ’  A  .  3  in  et  les  H  .  7 '*  7  ,  7b7  '  , 


a  t  out  ('  dornifero  general  ion  ,  dont 
ete  dfes  le  depart  census  avee  a 

on  flight  management  system): 

W'  f  .M.V  .  de  rdU  T  M‘j  pour  1  '  A  .  3  1  U  '  . 


propose  en 


opt  it 


( 

l  . 


■  fait,  dr  s  1<>77 
lbll  Tristar. 


P  .  fl.S.  con^ir  par  I  (HTML  f  D- ARM  A  '  etait 


It  n'y  a  par.  grand'chose  a  ajonter  sur  les  l  .M.S.  quand  on  a 
dll  qur  ee  snnt  dec;  sy;;tfenies  qui,  au  travers  d '  un  r.M.U.  uniqvie  et  r  e  1  a  t  i  v  ement 
romplexe,  t  arit  pour  son  clavier  qur  pour  1  1  informs  t  i  on  diffusive  dans  ses  "patjes") 
assurent  la  gent  ion  globule  du  vol,  aver  les  capacitrs  rajoutees  des  systfemps  de 
nnvigot  ion  dr  /one  et  des  P.M.S.  present  fes  p  reerdrmment  . 


In  resume,  le  I  .  (t .  5 .  : 


-  determine  fe  etiagne  instant  une  position  precise  de  1’ avion 
aver  une  precision  de  l'ordre  de  1/106  de  \H  en  /one  ouverte  rad i o-r lrct r i quo  )  ; 

-  determine  la  trajectoire  opt i male  dans  le  plan  vertical; 

-  guide  direct ement  1' avion  dans  les  trois  dimensions  par 
le  b  l a i s  du  pi  lot e  automat ique  et  des  nut  omanet  t  es; 

-  effect  up  tons  les  calculs  c oncer  nan t  la  navigation  (distan¬ 
ces,  heures  de  survol)  et  la  gestion  du  carburant  (eolculs  avant  vol,  calculs  d'auto- 
nomie  et  d'attente,  voire  do  dfeqaqemen t  en  vol). 


ttUHtsiA 
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Dans  leur  definition  actuelle  et,  a  fortiori,  dans  les 
versions  encore  ameiiorees  qui  verront  le  jour  dans  les  armies  b  venir  (et  qui  sont 
dejn  a  1' etude),  les  F.M.5.  permettent  : 

-  d'auqmeriter  la  sec u rite  en  doqaqeant  1' equipage  d'une 
charge  de  travail  que  les  calculateurs  peuvent  assumer  mieux  que  lui,  et  en  le  laissant 
disponihle  pour  traiter  des  prohlfcmes  (jraves  en  cas  de  n£cessite  (il  est  d'ailleurs 
svmpt  rnnat ique  que  -  en  dehorn  dn  t  onto  polemiquo  -  1' apparition  des  F.M.5.  corresponde 
a  unc  reduction  de  1 'equipage  minimal  de  conduite  sur  les  avions  de  premier  niveau); 

-  d'auqmeriter  la  rentabilite  par  une  optimisation  de  la 
trajectoire  dans  tout  os  les  dimensions,  avec  les  dconomies  en  carburant  qui  en 

re suite nt . 


5.  LES  VISEURS  DE  PILOTAGE 


5.1.  PRINCIPE  DE  BASE  DES  VISEURS  DE  PILOTAGE 


line  analyse  detaille5e  du  comportement  d'un  pilote  dans  les 
phases  devolution  nu  voisinaqe  du  sol  (decollage  et,  surtout,  at t err  issage )  montre 
qu'un  temps  considerable  est  perdu  pour  le  transfert  de  1 'attention  entre  : 

-  le  morule  exterieur  d'une  part,  v u  a u  travers  du  pare-brise, 
monde  vis-5-vis  duquel,  en  l'ytat  actuel  des  choses,  commence  et  s 1 achbvc  tout  vol  par 
un  contact  visuel  direct. 


-  les  instruments  de  pilotage  d' autre  part,  permettant  d'- 
avoir  aeces  au  travers  de  paramM  res  et  d'un  certain  symbol isme  a  une  trajectoire  non 
d i r  e c  t  e me n  t  accessible. 

[lien  que  cr:  phases  de  d^collage  et  d'atterrissaqe  np  consti¬ 
tuent  en  pourcontnge  de  temps  qu'une  part  infime  du  vol,  leur  importance  reste  primor- 
diale.  tiles  sont  en  particulier  le  sifcge  fie  l'ecrasante  majority  des  accidents  aeriens, 
et  sont.  de  ce  fait  traitor  avec  une  attention  par t  icul iferc . 

line  mnnifere  elegante  de  diminuer  la  perte  de  temps  en  transfert 
de  1' attention  consisto  a  fairr  apparnttre  dans  le  champ  visuel  tous  les  elements  neces- 
saires  a  une  bonne  apprehension  de  la  trajectoire.  L'oeil  du  pilote  n'a  plus  alors  qu'un 
object  if  sur  lequel  arco-nmoder :  le  monde  exterieur,  sur  lequel  viennent  se  superposer 
les  informations  appropriates. 


feci  est  possible  t echn i quement  au  travers  de  collimateurs 
' on  "H.U.P.",  Head  np  displays)  dont  la  definition  peut  £tre  ainsi  faite: 

-  une  rjlace  semi  roflechissante,  situde  au  voisinaqe  du  pare- 
brise,  laisse  au  pilote  In  vue  totale  sur  le  monde  exterieur; 


-  un  calculatcur  e labors,  au  travers  d'un  gyneSrateur  de 
synboles,  des  signnux  lumineux  (symboles  analocjiques  on  informations  numeriques)  qui 
sont  projet es  u  1' inf  ini  en  face  du  pilote,  et  viennent  se  superposer  pour  lui  au 
monde  exterieur,  nu  ils  sont  "per^ua"  ou  "lus"  sans  accommodation  part icul ifcre . 


A  parlir  de  ce  principe,  et  une  fois  les  difficulties  tech¬ 
niques  surmontees  (champ  nsse/  inste,  ohlenu  par  les  nouveaux  viseurs  "a  diffraction", 
s  v  c  u  r  i  t  v  ,  ohtenue  par  des  glaces  fac  i  lenient  effagahles,  voire  des  projections  directe- 
ment  dans  le  pare -brine,  finesse  de  In  symbol oqie,  adaptation  de  la  luminosity, 
eouleurs,  etc  diverse.,  solutions  pratiques  sont  possibles. 


fin  en  donne  seulrment  ci-dessous  deux  grands  types,  pour 
mont  rer  les  directions  dans  lesquelles  peut  se  d^velopper  1' evolution  des  viseurs 
de  pilot  age . 


5.2.  LES  VISEURS  "£l£MENTAIRES" 


harts  cess  premiers  viseurs,  dont  le  d£  vel  oppement  a  commence 
t res  t fit  en  I  ranee  d6s  la  fin  des  armies  soixnnte,  programme  IRA  au  Centre  d'Cssais 
en  Vol  de  RRI  TI(AY),  on  a  tenty  de  fournir  nu  pilote  des  paramMres  i4 1  yment  a  i  res , 
yiabor£s  b  partir  dr  capteurs  simples,  et  pr^sentys  sous  forme  analogique  plus  immy- 
fliatement  utilisahle  en  p  i  1  nt  age- r«4 f  1  ox  e  . 
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Ces  premiers  viseurs  ont  permis  de  repenser  d'une  certaine 
manifere  le  probl^me  du  pilotage,  en  fournissarit  au  pilote  des  paramfctres  en  prise 
directe  sur  la  trajeetoire  (incidence,  vecteur  vitesse,  pente  totale)  b  la  place  de 
paramdtres  classiques  cernant  cette  cette  trajeetoire  de  fa^on  plus  indirecte  ( "vitesse 
an^momdt r ique ,  assiette,  cap,  vitesse  verticale,  parammtres  figuratifs  de  la  poussEe 
des  mot  eurs  ) . 


Sur  lo  plan  de  1 ' am ronaut i que  civile  commerciale,  le  premier 
viseur  de  cette  tendance  b  avoir  etm  commercialism  a  mte  le  viseur  C.S.f  .  193  qui, 
install^  sur  1' avion  Her  cure,  a  permis  dfes  le  ddbut  des  an  rimes  soixarit  p-di  x  d'en 
abaisser  de  fa^on  spec t acu  1  a i r r  les  minimums  d'approche  (en  approche  de  prmcision  do 
catmgorie  III)  par  1 1  aide  qu'il  npportait  a  la  transition  vol  aux  instruments  -  vol  a 
vue  . 

Ac t ue 1 1 emen t ,  le  viseur  de  cette  tendance  le  plus  s iqn i  1  i c at i f  , 
bien  qu'il  n'ait  pas  mte  commercialise  (a  l'encontre  d'un  de  ses  homo logues  installe 
sur  Super-E  t  endard  )  est  le  TH0M50N-CSF  TC.125  ff'A.  De  nombreuses  campagnes  devaluation, 
ouvertes  b  de  nombreux  const  rue t eurs ,  utilisateurs  et  services  officiels,  ont  mis  en 
evidence  les  performances  particuli&rement  interessantes  de  c e  viseur. 

!?es  ca  rac  t  e  r  is  t  iques  sommaires  sont  les  suivantes  : 

-  figuration  de  pararnmtres  element  a i res  directs  de  pilotage 
(incidence,  vecteur  vitesse,  pente  totale)  miaborms  a  partir  de  moyens  simples  (sonde 
d1  incidence,  accc leromfet res ,  rmference-  inert iel les  ) ; 

-  figuration  d'une  piste  synthotique  qui  vient  de  superposer 
a  la  vraio  piste  en  vol  a  vue,  a  partir  des  signaux  Iff)  "liases"  par  inertie); 

-  pilotage  au  travers  de  boucles  loqiques  racco.ies  dans 
lesquelles  le  pilote  reste  un  Element  essentiel; 

-  technique  de  vol  plus  simple,  identique  on  conditions  de 
vol  h  vue  vlflC )  et  de  vol  aux  instruments  ,  I  Mr  ) ; 

-  meilleure  rdponse,  grace  b  des  temps  do  reponse  plus  courts, 
en  cas  de  perturbations  externes  gradient  de  vent)  ou  internes  (perte  d'un  moteur); 

-  remarqviable  adaptation  b  la  transition  vol  aux  instrument  s- 
vol  vue,  comme  il  a  etc  dit. 

5.3.  LES  VlSEURS  "DIRECTIFS" 


Birn  quo  les  visours  "c  1  mment  a  i  re  s*»  ci-dessuo  presentEs 
puisserit  apporter  de  prof  ends  a  vantages  par  lour  principe  nipme,  ce  no  sont  pan  for  ce¬ 
ment  eux  qui  s'imposeront  les  premiers  dans  lo  domaine  de  l'aviatiofi  commerciale. 

D'autres  v  incurs  out  suiv  i  un  dove  1 oppement  parallel*’,  en 
particulier  sous  les  auspices  de  la  \ASA,  et  ont  about  i  a  lies  realisations  commercia- 
les,  comme  le  viseur  Sundstrand  propone  et.  option  sur  le  DC. 9  -  HO  helas  pEnalisE  par 
so n  absence  de  rmference  inertie  lie). 

r*a  vise  urn,  dont  le  viseur  A.M.D,  PIR^fTOLIf?  (proche  du 
viseur  du  Mirage  2000  en  ce  qui  concerne  les  fonctions  pilotage)  est  un  des  plus 
s  igni f icat if s ,  peuvent  avoir  les  c  a  rar  t  m  r  i  s  t  i  goes  suivantes  : 

-  Figuration  de  paramEtres  He  vol  plus  "classiques", 
assiette  et  "vitesse"  anEmomEtrique  par  exemple; 

-  figuration  d '  un  rectcur-  vitesse  "sol",  mo  ins  facile  d' ela¬ 
boration  quo  le  veetpur-vit  ease  "air"  des  v  incurs  "m  lmrnent a  i  res"  ,  et  plus  attrayant 
pour  I'utilisnteur  mEme  ni  parfois  mo ins  fiable; 

-  prEsentat  ion  d'un  "directeur  de  vol",  sorte  de  "boite"  dans 
lag  ue  lie  il  convient  de  piloter  ie  vpcteur-vitrssr  pour  rejoin  dre  et  suivre  une  trajpe- 
toire  non inale  -  au  prix  de  1 ' m 1 im limt ion  du  pilote  de  la  boucle  de  pilotage  ou  un 
ealculateur  le  r emplace; 


-  prmsentntion  d’un  "directeur  de  pouss^e",  sorte  de  "boite" 
dans  laquelle  il  convient  de  "piloter"  les  rrpEros  d'energie  totale  de  1 'avion,  en 
s'aidant  des  Elements  agissant  sur  le  bilan  poussee-t  rainfle,  manettes  des  qa*  en  parti¬ 
culier; 

-  Elaboration  d ' une  piste  synthmt  i  que  utile  h  1  a  t rans it  ion 

/  vol  aux  i not  rumen t s- vol  A  vue. 
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5.4.  LES  VISEURS  DE  LA  FIN  DU  SIECLE 


font  ra  i  re  merit  aux  autre:;  compos  ants  de  i  'avion  commercial 
"de  1 ' an  20U0",  qui  progress ivempnt  se  met  tent  en  place  cur  lea  nouveaux  produits  de 
1*  Industrie  aeronaut  i  que ,  les  viseurs,  tout  en  cord  muant  h  progresr.er  dans  ]e  domaine 
de  l'dtude  ^.surtout  en  France,  an  Pent  re  d'tsuais  en  lol  ,  et  aux  (.  t  a  t  s-Un  i  a  ,  a  ia  NANA, 
marquent  le  pas  dans  le  domain**  dec  realisations  pratiques. 

(el a  eat  dO  a  plusieurs  raisons,  en  particulier  a  la  necessi¬ 
ty  pour  lea  const ructeura  d' amort ir  de  roflleuses  etudes  sur  lea  pilotea  a ut oma t i que s 
(qui  aemblent  dans  un  premier  temps  roncurrencer  lea  viseurs),  a  1  '  ahaisiscnicnt  relatif 
du  coOt  de adits  pilotea  automatic]  up  a  aver  l'avbnemprit  ti  u  numeri que,  a  la  retieef.ee 
enf  in  d'utiliaateura  asae/  corn  erit  lormela  a  dea  pas  e  n  avarit  trop  reformat  eurs . 

(Juoi  qu'il  (M»  suit,  et  1' exemple  de  la  navette  apatiale  n'en 
est  qu'un  exemple  parmi  d'autres,  les  viseurs  de  pilotaqe  auront  probab  lenient  une 
place  essentielle  dans  1' interface  homme-mach i ne  de  1 'avion  commercial  de  la  fin  du 
sifecle  -  bien  qu'il  soit  difficile  rl'en  prdvoir  aujourd'hui  leur  forme  exact  c. 


6.  AUTRES  ASPECTS  DE  L ' INTERFACE  DE  DETAIN 


6.1.  LES  POSTES  DE  COMMANDE  MULTIPLEXES. 


In  plus  dea  qr  a  rules  ten  dances  presentees  p  1  u  ii  haul,  1' inter¬ 
face  homme-mach i ne  dea  avions  commerciaux  de  la  prochaine  goner a t i on  va  presenter  dec 
nouveautes  qui,  pour  dtre  mo  ins  import  antes,  n'en  auront  pas  moins  dea  ret  ombdea  qui 
modi f ieront  prof ondemont  1 ' env i r onnrmen t  classique. 

f’armi  (‘lies,  lea  postes  de  commando  multiplexes. 

I  e  pr  i  n  c  ipe  do  c e s  postes,  d o n  t  certains  s o r 1 1  d e  j  a  on  service 
de  fa?on  limitde  dans  1 'aviation  d'affaires,  et  les  plus  evoluds  en  essoin,  est  le 
a  u  i  v  a  n  t  : 


les  cockpits  actuels  r»ont  eneombros  de  poste  de  commando 
divers  dont  la  manipulation  n'irrtervient  que  pendant  une  partie  t  r lir  itee,  pour 
ne  pas  dire  nbqliqeable,  du  vol.  Par  exemple,  sur  un  avion  equip?  de  troia  postes 
\.H.F.,  le  V.H.f  .2  utilise  pour  leiller  la  frequence  de  ddt  resse  121.fi  MHz  ne  sera 
pas  manipuly  de  tout  1 e  vol  alora  qu'il  occupe  une  place  non  neq 1 i qe able  dans  le 
cor kp i t . 


Un  a  done  imaqind  dec  postes  de  commando,  qui  ne  sont  aut res 
que  vies  r.D.U.  part  i  cu  1  iera  ,  qui  permettent  d(‘  a  '  adr  esse  r  ,  au  travels  d'un  programme 
simple,  h  different:;  postes  concernant  les  communications  (V.H.f  H . f  . ^ ,  les  movens 
de  navigation  ;  \  0P. ,  1)1H  ,  A1)F  ,  INS)  et  de  quidaqe  (1L5,  MLS),  les  movens  de  visualisa¬ 
tion  radar,  MUD )  etc... 


Lorsqu'un  dcs  menihres  d' equipage  vent  modifier  un  affichaoe 
(par  exemple  la  f  rdquericc  du  poet  e  Hi  .2),  il  "oppelle  ce  poste"  a  son  I'PU  vil  y  a  un 
r.D.l).  de  ce  type  par  piloted,  vdrifio  la  frequence  en  service  .et  event uellement  la 
frequence  affiehde  en  reserve),  et  prordde  par  frappe  (au  clavier  alphanumdr  ique )  et 
insertion  pour  aff  ichor  une  nouvelle  frdquence. 

Le  f.D.IJ.  du  poste  de  commando  multiplexd  s'odreasant  a  un 
calculateur  equipd  de  memo  ire,  on  pout  mdmo  imaijiner ,  pour  dliminer  dec  erreura 
potent,  ielles,  de  fa  ire  afficher  par  le  membre  d'dquipaqe-opdraleur  : 

-  un  indicatif  de  V  OR  /DMT  (et  non  une  frdquence''  pour  afficher 
la  frdquence  correspondante  au  poste  V/HF.NAV; 

-  un  indicatif  d'adrodrome  et  de  UfU  (par  exemple  LFPG  27 
pour  le  (JFU  2  7  5  PARIS-CDG)  pour  afficher  a  la  fois  la  frdquence  I L  f>  correspondante 
au  poste  ILS,  et  les  paramdtres  de  la  piste  (orientation  exacte,  longueur,  pente  du 
glide)  au  poste  de  commande  du  HUD  pour  1 ' d  1  ah  or  a t  i on  de  la  piste  synthdtique. 

les  postes  de  commando  multiplexes  permettrant  dans  les 
amides  h  venir  5  la  fois  de  ddqaqer  les  cockpits  et  tie  permettre  un  gain  de  poids 
notable. 


6.2.  LA  TECHNIQUE  "POUSSE-BOUTON 


Dans  la  perspective  de  1 1  a  1 l&qement  des  cockpits,  on  ne 
peut  passer  sous  silence  le  proqrfes  spec taculaire  apporte  par  la  technique  dite 
"pousse-bouton",  qui  a  ete  par t icu 1 ib rement  developpee  sur  l'A.310. 

Dans  1* interface  classique  des  avions  commerc l a ux ,  une 
anomalie  (ou  une  panne)  est  siqnalee  par  l'allumaqe  d ' un  voyant  lumineux. 

Pour  identifier  1 'anomalie,  l'equipage  est  conduit  h  rrlrver  les  indications  d' un  ou 
plusieurs  instruments,  et  a  procbder  pour  faire  disparaltre  l'anomaiie  a  une  action 
sur  un  actionneur  elect ro-mdcan ique  (bouton,  basculeur,  robinet  ou  outre). 

Dans  la  technique  " pousse -bout  on" ,  on  romp  lace  1* ensemble 
voyant/instrument/actionneur  par  un  bout ou-pousso i r  a  eclairaqe  ini  ogre  unique. 

Lorsque  tout  va  bien,  ce  bouton  poussoir  est  eteint.  S'il  vient  a  s'allumer,  il 
siqnifie  qu'une  panne  a  bte  detector,  et  qu'une  pression  sur  lui-mfme  produira  les 
actions  propres  h  remedier  5  la  panne. 

La  procedure  d 1 ut i 1 isat i on  de  ce  syst&me  est  done  la  suivante 

-  bout on-pouss o i r  eteint  r  tout  va  bien 

-  bout on-pousso i r  allume  =  on  le  presse,  il  s' eteint  ou  reste 
allumb  cl ' une  couleur  convent ionne 1 le  siqnifiant  "etat  degrade"  =  la  panne  a  etc  rontrbe 
Pour  plus  de  reuse iqnements  sur  1'etat  rbsiduel  du  systfcme  eoncerne,  il  outfit  de  se 
reporter  ti  un  tube  cathodique  desrriptif  du  systdme,  romrne  presente  plus  haut  . 

line  telle  technique  prime t  a  la  foil-,  d'alleqer  le  cockpit  , 
et  de  diminuer  la  charge  de  travail  et  les  risques  d'erreur  de  1' equipage. 


CONCLUSION 


S'il  est  un  domaine  ou  il  font  bien  se  qarder  de  faire  des 
predictions,  et  de  depeindre  l'avenir  vingt  ans,  voire  di\  ou  cinq  a  1 'runner,  e'est 
bie.  celui  de  1 '  aeronaut  ique  .  l)n  contexte  essen  t  i  t  1  1  ement  changoant ,  dans  1  c  domaine 
technique  mals  aussi  dans  le  domaine  econcmiquc,  lend  alcatnire  t  out  r  provision  a  long, 
voire  a  moyen  terme.  Qui  aura  it  pu  prevoir,  h  1' apparition  des  ' upc r - Tons t e 1 1  a t i on , 
que  ces  appareils  seraient  pbrimbs  avant  mbmc  d'avuir  vole,  deiant  la  poussee  du  trans¬ 
port  li  reaction  ?  Qui  aurnit  pu  prevoir,  a  l'apparition  du  Tone  or  de,  <i  Li  t'  le  transport 
supersonique  allait  devoir  at  t  metre  encore  son  hetire  quolquer*  decermies  ? 

Maiqro  les  incertitudes  s*  I'avenir,  il  n'ost  pas  interdit 
de  relever  des  tendances,  et  tie  prevoir  aver  certai.i.;  chances  dr  succbs  que  eertaines 
seront  irrbversibles.  ft  clans  lc  domaine  de  1' interface  homme-mach i no ,  ou  la  continuite 
des  tendances  semhlo  plutflt  M  re  la  rbglc,  on  peut  iwauinrr  gup  les  points  abordbs  plus 
haut,  tubes  cathodiques  de  plnnche  tie  bord,  systbmrs  de  gestiun  du  vol,  collimateurs  de 
pilotage  et  d'autres  encore  b  peine  (teasings  const  i  t  uerorit  les  lignes  de  force  de  poste 
de  pilotage  des  avions  commereinux  de  l'an  201)0. 
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Summary : 

The  classification  of  human  errors  (H.E.)  by  category  and  conditions  of  occurence 
is  presented.  According  to  the  conditions  and  causes  of  H.E.  occurence  different  means  of 
preventing  H.E.'s  by  ergonomic  design,  by  manning,  selection  and  training  are  considered. 
In  flight  deck  design  -  besides  conventional  ergonomic  design  -  two  strategies  are  pro¬ 
posed: 

(1)  Provision  of  sufficient  feedback  to  allow  the  pilot  to  detect  and  correct  uninten¬ 
tional  performance  errors  before  they  affect  system  performance. 

(2)  Introduction  of  "fail  safe  and  fail  ops.  ergonomic  design*  by  means  of  H.E.  detec¬ 
tion  and  correction  functions  designed  into  the  man-machine  interface  intelligence. 

The  last  generations  of  aircraft  are  compared  regarding  their  task  and  system  com¬ 
plexity.  The  increased  complexity  formed  the  need,  and  the  advances  in  electronics  pro¬ 
vided  the  means  for  the  new  integrated  flight  deck,  based  on  a  cockpit  data  management 
system  that  includes  ’error  monitoring  capabilities*.  Finally  the  pilot's  cockpit  re¬ 
quirements  of  fire/flight  control  and  post-stall-manoeuvring  modes  are  discussed,  requi¬ 
ring  increased  automation,  information  feedback  loops  and  a  "reconfiguration*'  of  the 
pilot's  task  load. 

Introduction 

Increasing  capabilities  of  to-day's  fighter  aircraft  are  based  on  fly-by-wire  and 
digital  electronics  technologies,  and  on  improved  weapon  and  sensor  concepts.  We  are  de¬ 
signing  poststall,  coupled  fuselage  aiming,  and  other  flight  characteristics  into  the 
aircraft  and  are  including  advanced  radar  and  electro-optical  sensors  and  weapons  into 
the  weapon  system.  These  modes  and  techniques  require  a  flight  deck  enabling  the  pilot/ 
aircrew  to  fly  them,  and  -  besides  that  -  to  handle  all  systems  appropriately  to  effec¬ 
tively  fulfill  the  mission. 

The  flight  deck  design  task  is: 

To  provide  a  work  environment  and  situation  equating  the  pilot's  capabilities  and 

needs . 

This  can  only  be  done  by  a  highly  sophisticated  Cockpit  Data  Management  Concept, 
which  provides: 

o  display  functions  selected  by  task  and  phase  of  mission 

o  display  feedback  on  system  and  sensor  functions  selected 

o  control  feedback  to  the  pilot  on  control  authority  states  in  the  new  control  modes 

o  task  load  monitoring 

o  fail  safe/fail  ops.  monitoring  of  pilot's  performance  whereever  applicable. 

To  achieve  this  design  goal  a  certain  knowledge  on  the  nature  of  human  errors  and 
the  conditions  of  their  occurence  is  required. 

Classification  of  Human  Error  (H.E.) 

In  the  research  concerning  human  reliability  quite  a  number  of  classification 
schemes  of  H.E.s  have  been  developed.  All  are  based  on  one  of  the  dimensions: 

o  category  and/or  type  of  H.E. 

o  cause  conditions 

o  conditions  of  H.E.  occurance 


(1)  Classification  by  category 

Most  classifications  can  be  subsumed  under  the  following  categories: 


safe*  . 
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a)  Action  error  (substitution,  reversal,  adjustment  etc.) 

b)  Sequence  error  (e.g.  mix  up  of  procedure  steps) 

c)  Time  error  (out  of  phase  or  execution  too  slow  etc.) 

d)  Omission  error  (forgetting  of  check,  default  action,  step  etc.) 

e)  Addition  error  (unintentional,  unneccessary ,  unrequired,  superflous  action) 

This  line  of  thought  is  followed  by  Swain  (1963),  Meister  (1964)  and  by  others. 

This  classification  deals  with  the  error  as  such,  not  with  the  cause  factors  in¬ 
ducing  the  error.  This  approach  of  discriminating  distinctly  between  a  fact  (e.g.  inci¬ 
dent  or  accident)  and  the  cause  or  chain  of  cause  factors  behind  that  fact  is  known  from 
accident  research  already  (Seifert  et  al ,  1980). 

(2)  Classification  by  cause  conditions 

Swain  (1980)  distinguishes  between  "Situation  Conditioned  Error"  (SCE)  and  "Human 
conditioned  Errors"  (HCE).  Embrey  (1976)  discriminates  the  "predisposing  factors" 
as  "Situational"  or  " Id losynchrat ic" . 

As  far  as  flight  deck  design  is  concerned,  we  have  to  consider  how  to  prevent  such 
situational  conditions  to  manifest  themselves  in  the  cockpit  design  or  in  the  wea¬ 
pon  system  operations.  However  before  we  discuss  this  task,  we  should  highlight  the 
third  classification,  which  overlays  the  SCE/HCE  classification,  and  concerns  the 
conditions  of  H.E.  occurance. 

(3)  Classification  by  conditions  of  occurence 

Rigby  (1969)  distinguishes  between  systematic,  random  and  sporadic  H.E.s. 

a)  Systematic  H.E.s 

Both  SCEs  and  HCEs  can  be  conditioned  systematically. 

A  typical  example  for  a  systematic  SCE  is:  Substitution  error  between  flaps  and 
wheels  lever.  In  the  classic  study  by  Fitts  and  Jones  (1947)  this  error  amounted 
to  31  *  of  the  controls  substitution  errors.  This  is  a  systematic  error  induced 
by  cockpit  design.  Even  to-day  there  are  aircraft  of  one  manufacturer  on  the 
market,  which  are  inducing  this  systematic  error  by  their  cockpit  design. 

Systematic  SCEs  can  occur  due  to  inappropriate  selection  methods  and  due  to  in¬ 
appropriate  training  as  well. 

Systematic  HCEs  occur  due  to  a  bias  in  human  performance  caused  by  loss  of  fit¬ 
ness  or  motivation,  by  fatigue  etc.  That  means  a  systematic  out-of-tolerance  de¬ 
gradation  of  human  performance. 

b)  Random  H.E. 

Random  H.E.s  occur  due  to  the  randomness  in  the  variation  of  human  activity  and 
performance.  Even  a  fully  qualified,  trained,  experienced,  and  practiced  opera¬ 
tor  shows  variations  in  performance.  Random  errors  are  explainable.  They  occur 
inevitably,  due  to  overlooking,  slipping,  forgetting,  erroneous  retrieving,  er¬ 
roneous  concluding  etc. 

They  can  not  be  excluded  by  conventional  ergonomic  optimization  of  the  design, 
not  by  personnel  selection  and  not  by  training  and  practice. 

Random  H.E.s  are  random  only  in  terms  of  interindividual  occurance.  Intraindivi- 
dually  there  is  a  non-random  bias  due  to  personality  traits. 

The  "sporadic  errors"  as  defined  by  Rigby  (1969)  are  errors,  that  cannot  be 
explained.  They  "just  occur”.  Davis  (1948)  described  them  as  "apparently 
unreasonable,  and  stupid  mistakes",  and  named  them  "lapses". 

With  regard  to  flight  deck  design  the  sporadic  errors  or  "lapses"  can  be  treated 
as  random  errors.  The  only  difference  between  the  two  is:  random  errors  have 
causes  which  are  more  or  less  apparent,  the  lapses  have  not. 

To  summarize:  A  systematic  H.E.  is  predictable,  because  identical  situations 
(design  failures  etc.)  result  in  the  same  type  of  error. 

Random  H.E.s  are  not  predictable.  They  require  a  new  approach  within  the  system 
design  task. 


Treatment  of  H.E.s  in  flight  deck  design 


Fig.  1  shows  a  general  breakdown  of  H.E.s  occurence  and  their  dependency.  In  the 
lower  part  the  responsibilities  for  H.E.  prevention  are  named. 

In  conventional  flight  deck  design  systematic  H.E.s  are  prevented  by  the  applica¬ 
tion  of  ergonomic  design  procedures.  With  this  conventional  ergonomic  design,  we  do  our 
best  to  provide  equipment  functions,  man-equipment  interface,  handling  qualities  and 
operating  procedures,  being  in  compliance  with  ergonomic  requirements.  This,  however,  is 
not  enough  in  the  light  of  the  design  of  an  "integrated  cockpit",  and  the  design  of  "new 
control  modes"  as  specified  for  future  fighter  aircraft  weapon  systems. 

Even  if  we  are  ahle  -  by  ergonomic  design  -  to  preclude  systematic  H.E.s  to  occur, 
random  H.E.s  will  happen  to  occur  with  a  frequency  of  1  in  100  to  1  in  1000  per  unit  mea¬ 
sure  (tasks,  events,  time  cycles).  Random  H.E.s  can  not  be  prevented  to  occur.  They  hap¬ 
pen  -  as  has  been  stated  above  -  due  to  normal  variations  in  human  performance.  To  reduce 
effects  random  H.E.s  may  have  on  system  performance,  a  new  strategy  is  required  in  flight 
deck  design. 

It  is  known  that  "humans"  normally  "operate"  as  closed-loop  system,  detecting  and 
correcting  their  own  errors  (J.A.  Adams,  1982).  Consequently  one  design  strategy  is,  that 
we  provide  feedback  loops  in  the  system  or  equipment  functions,  which  support  the  human 
operator  in  detecting  and  correcting  unintentional  performance  errors,  before  they  can 
affect  system  performance.  There  is  a  second  strategy,  which  can  be  applied  in  all  cases, 
where  human  performance  errors  can  be  detected  and  evaluated  by  the  system.  For  those 
H.E.s  an  error  correction  function  can  be  designed  into  the  system.  This  task  is  called 
"fail  safe  and  fail  ops.  ergonomic  design"  (in  Fig.  1).  The  goal  of  this  second  strategy 
is  to  achieve  a  certain  tolerance  of  the  technical  system  against  human  performance  er¬ 
rors. 


By  the  application  of  this  design  strategy  we  do  not  tolerate  design  failures,  per¬ 
sonnel  selection  or  training  failures,  which  lead  to  predictable  systematic  H.E.s.  We 
only  tolerate  those  human  performance  errors,  which  occur  in  spite  of  the  compliance  of 
the  system  and  its  interfaces  with  the  defined  human  performance  capabilities. 

The  design  goal  for  new  flight  deck  design  is  to  provide  mutual  monitoring  of  man 
and  the  technical  system.  The  human  operator  monitors  and  controls  his  system  and  his  own 
performance,  and  in  addition  the  technical  system  monitors  the  human  operator  performance 
whereever  applicable. 

Flight  Deck  Design  Concepts 

In  the  past  new  design  concepts  often  were  realized  by  simply  adding  new  techniques 
or  systems  to  those  already  installed.  This  resulted  in  extended  flight  capabilities  and 
in  greater  mission  flexibility.  However,  the  pilot's  workload  increased  as  well. 

Fig.  2  to  4  show  block  diagrams  of  aircraft  of  different  generations.  The  blocks  of 
new  systems  and  those  in  which  new  functions  (tasks,  subsystems)  were  added  are  marked 
(•)  with  a  dot.  The  increase  of  functions  by  number  (displays,  controls)  is  known  from 
previous  investigations  (Ostgaard,  1981,  and  Lyons  and  Roe,  ’980). 

Fig.  5  and  6  show  the  follow-up  from  F-15,  Tornado  and  F-18  to  th  ’  1990  fighter  air¬ 
craft.  It  can  be  seen  that  the  "cockpit  integration"  leads  to  a  reduction  of  displays 
ranging  from  40  *  to  50  S.  The  controls  are  reduced  only  by  20  %  to  25  *.  This  supports 
the  conclusion  drawn  in  earlier  investigations  (Seifert,  1981,  and  AFFDL ,  1977)  that 
multifunction  controls  are  even  more  important  and  intricate  in  terms  of  success  of  the 
"digital  cockpit"  than  mu  1 1 i f unct ion  displays. 

For  the  future  fighter  aircraft  this  additive  concept  is  no  longer  acceptable.  The 
F-18  represents  the  first  generation  of  aircraft  with  a  flight  deck,  to  which  the  term 
"integrated  cockpit"  applies.  Yet  even  the  F-18  does  not  mark  the  end  of  flight  deck  de¬ 
sign  and  aircraft  capabilities.  The  future  fighter  aircraft  has  the  following  features: 

o  Flight  deck  with  tiigh  functional  flexibility,  based  on  the  installation  of  a  "cock¬ 

pit  data  management  system"  (CDMS),  as  presented  in  Fig.  7  and  8. 

o  New  performance  modes  "coupled  fuselage  aiming",  "post,  stall  manoeu  v  r  ab  l  1 1 1  y ''  and 

possibly  "direct  lift  control",  "drag  modulation",  or  other  manoeuvre  enhancement 
modes . 

o  Extended  digital  avionic  and  digital  flight  control  systems  using  Mil-Bus  data 

h ighways . 

The  resulting  tasks  for  the  flight  deck  design  are: 

a.  Monitoring  of  task  load  and  information  flow  in  the  cockpit,  to  limit  pilot's  work¬ 
load  in  all  flight  and  mission  phases. 

b.  Provide  information  feedback  to  the  pilot  where  appropriate  to  enable  him  to  moni¬ 
tor  the  validity  of  this  performance. 
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c.  Provide  appropriate  information  to  the  pilot,  in  order  to  avoid  undue  reactions 
(even  spatial  disorientation)  by  strange  motion  cues  during  new  extended  mode 
manoeuvres . 


d.  By  allowing  for  ergonomic  design,  decrease  the  probability  of  systemat 1 c  H.E.s 
( pi  lot  errors ) . 

e.  Increase  the  ability  of  the  system  to  tolerate  and  compensate  H.E.s  (pilot  errors) 
where  applicable. 

Only  if  these  tasks  are  accomplished  by  the  new  flight  deck  design,  the  pilot  will 
be  enabled  to  fully  utilise  the  extended  system  and  performance  capabilities  of  the  fu¬ 
ture  fighter  aircraft. 

Cockpit  Data  Management  System 

A  first  concept  for  handling  the  data  management  in  an  integrated  cockpit  was  pre¬ 
sented  in  an  earlier  AGARD  conference  (Seifert,  Denkscherz,  1977).  This  concept  included: 

a.  Moding  by  flight  or  mission  phase 


Integrated  display  and  display  information  flow  management 

Pilot's  authority  to  operate  individual  systems  within  or  outside  the  mission  mode 
selected . 


Meanwhile  the  concept  was  realized.  However,  with  the  realization  new  ideas  are 
formed  to  upgrade  this  concept  by  an  error  management  feature  for  pilot  command  and  data 
input  functions.  The  block  diagram  of  the  cockpit  data  management  concept  is  presented  in 
Fig.  8. 

From  Fig.  8  it  can  be  seen,  that  the  new  flight  deck  design  is  based  mainly  on  mul¬ 
tifunction  displays  and  controls,  and  on  the  MIL-BUS  application.  With  increasing  confi¬ 
dence  in  and  proof  of  the  reliability  of  MIL-BUS  systems,  the  "direct  wired"  data  flow 
between  aircraft  systems  and  cockpit  will  decrease  further.  Even  the  backup  instruments 
and  warnings  may  be  wired  through  the  MIL-BUS  by  then. 

From  the  multifunction  concept  follows,  that  the  ergonomic  design  tasks  are  more 
and  more  encompassing  both,  the  hardware  and  the  software  specification.  In  this  context 
the  terras  "error  management"  and  "error  tolerant"  in  relation  to  human  error  emanated  and 
became  meaningful.  Recently  "error  management  requirement  of  such  software  dependent  man- 
machine  interface”  were  defined  by  S.L.  Smith  (1981). 

Smith  defined  16  basic  error  management  requirements.  If  you  closely  look  at  them, 
they  can  be  categorized  as  follows: 

(1)  H.E.  monitoring  with  automatic  correction  and  display  feedback,  or  with  feedback 
for  correction  by  operator. 

(2)  Protection  of  system  (store,  stack)  against  H.E. 

(3)  Allowance  for  the  operator  to  correct  se 1 f -detected  errors. 

(4)  Interface  functions  logic  layout  requirements 

We  transformed  this  information  to  allow  their  incorparat ion  into  the  requirements 
for  new  flight  deck  design: 

(1)  H.E.  monitoring  with  automatic  correction  and  feedback,  or  with  feedback  for 
correction  by  the  pilot. 

This  capability  should  be  installed  in  conjunction  with  command  entries  and 
data  entries  regarding  certain  typical  H.E.s: 

o  Action  errors 

Entries  which  are  logically  inappropriate,  unidentifiable  (e.g. voice),  or 
ambiguous 

o  Sequence  errors 

Invalid  step  within  an  entry  sequence,  e.g.  in  navigation  data  entry  or  sys¬ 
tem  functions  command-sequence. 

o  Omission  errors 

Default  command  or  data  entry. 

o  Addition  and  Time  errors  (according  to  H.E.  classification)  are  obviously 
subsumed  under  the  above  action  errors  in  Smith's  repertiore.  They  have  to  be 
considered  here,  e.g.  a  function  command  that  is  out  of  phase  within  the  sys¬ 
tem  control  in  a  given  mission  phase. 


(2)  Protection  of  system  against  H.E. 


Certain  data  manipulation  actions  should  be  made  safe  against  human  decision 
and  command  error.  Smith  (1981)  recommends  an  operator  self-check. 

In  critical  situations  concerning  integrity  of  program  and  data  store  the  sys¬ 
tem  requests  the  operator  to  "confirm"  a  command  entry  before  it  is  executed  by 
the  system. 

This  is  recommended  to  be  done  in  case 

o  an  extensive  change  (e.g.  deletion  or  mission  planning  alteration)  of  stored 
data  is  commanded 

o  of  log  out  command  is  given  (e.g.  out  of  a  check  procedure)  before  other  pen¬ 
ding  transactions  were  performed. 

(3)  Allowance  for  the  operator  to  correct  se l f-detected  own  errors. 

This  is  based  on  the  "closed  loop  performance"  characteristic  of  man,  as  detai¬ 
led  by  Adams  (1982),  which  was  mentioned  earlier. 

The  system  shall  allow  for: 

o  Immediate  correction  of  entry  i.e.  while  the  entry  is  still  in  mind  and  the 
source  data  still  at  hand. 

o  Easy  return  to  previous  steps  for  correction  of  data  or  sequence  error  or  in¬ 
troduction  of  desired  change,  e.g.  extended  command  entry. 

(4)  Interface  layout 

This  category  de„ls  with  the  avai labi 1 ity,  consistency  and  flexibility  of  use 
of  entry  functions: 

o  Layout  and  consistency  of  ENTER  function 
o  Feasibility  and  layout  of  a  CONFIRM  function 

o  Flexibility  of  data  change  and  function  command  entries  within  a  master  mode. 

o  Data  entry  consistency  over  the  displays  and  keyboards  in  the  cockpit. 

All  these  design  tasks  are  typical  software  ergonomic  tasks.  It  is  not  "error 
management"  in  terms  of  H.E.  monitoring  through  the  cockpit  data  management 
system.  According  to  the  classification  of  H.E.s  as  shown  in  Fig.  1,  this 
interface  layout  shall  r>e  such,  that  "system  induced  H.E.s"  are  prevented  to 
occur . 

To  summarize  the  error  monitoring  tasks  within  the  CDMS,  this  system  shall  in  this 
priority  sequence: 

o  detect  and  correct  pilot  entry  errors 

o  detect  entry  errors,  and  display  message  for  the  pilot  to  take  corrective  measures 

o  detect  potential  loss  of  stored  data  due  to  pilot  action,  and  ask  pilot  for  advice 

o  by  information  feedback  on  pilot  actions  make  allowance  for  pilot’s  capability  to 

correct  self-detected  own  errors. 

Advanced  manoeuvrability  modes 

Since  the  "advanced  fighter  technology  integration"  (AFTI)  program  has  been  initia¬ 
led  (Martin,  1973,  Wetmore,  1976),  a  number  of  projects  evolved,  aiming  at  higher  man¬ 
oeuvrability  and  more  sophisticated  weapon  system  capahi 1 i t les .  There  are  the  "F-15  Inte¬ 
grated  Fire  Flight  Control"  (IFFC)  program,  the  Advanced  Manoeuvring  Attack  System 
(AMAS),  and  similar  European  programs. 

Not  all  of  the  programs  include  a  capability  fot  a  si x-deg ree-of - f reedom  control. 
However,  any  enhanced  manoeuvrability  has  to  rely  not  only  on  an  advance,  d 1 spl ay /control 
incept,  but  also  on  a  higher  degree  of  automation. 

This  increased  automation  in  trajectory  and  attitude  control  requires  new 
information  feedback  loops,  to  keep  the  pilot  informed  about  system  states,  processes, 
mod'*:;  and  about  the  authorithy  range  and  limits,  in  which  he  is  operating.  This  has  been 
i  •■■•oinmended  already  in  the  report  of  the  "Committee  on  Automation  in  Combat  Aircraft" 
,wnd''.-;,  1982  ). 
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In  to-day's  aircraft  we  have  installed  emergency-prevention  devices:  Examples  are: 
o  angle  of  attack  and  g-force  limiters  (F-16) 

o  stall  indicators  (F-11I) 

o  stall  prevention  and  incidence  limiting  system  (TORNADO) 

With  these  devices  installed,  and  with  the  application  of  the  fly-by-wire  techno¬ 
logy  for  flight  and  propulsion  control,  we  have  the  means  available,  to  give  the  pilot 
all  the  information  he  needs,  and  to  relieve  him  from  tasks,  he  no  longer  is  able  to  ac- 
corapl ish. 

(1)  Fire/flight  control  modes 

In  this  mode  the  following  control  functions  are  automated: 
o  attitude  and  trajectory  control  after  lock-on 
o  target  detection,  acquisition  and  identification 
o  target  pr ior i zat ion . 
o  weapon  launch  (missiles) 

By  this  automation  greater  system  effectiveness  is  achieved.  The  pilot's  workload 
does  not  decrease.  However,  the  automation  of  the  continuous  control  functions  al¬ 
lows  to  "reconfigure"  the  workload  of  the  pilot.  He  is  enabled  to  keep  his  mind 
free  for  tactical  and  attack  monitoring  tasks.  The  manual  functions  left  are: 

o  mode  selection 

o  propulsion  control  (if  not  automated) 
o  sensor  system  control 
o  weapon  launch  (gun,  rockets) 

o  override  of  automatic  control  and  of  target  prior i zat ion . 

Besides  these  manual  functions,  there  is  a  definite  requirement  for  information 
feedback  to  the  pilot  regarding  the  automatically  controlled  functions.  These  feed¬ 
back  display  requirements  include: 

o  attitude  and  trajectory  (flight  director)  information 
o  target  and  sensor  information 
o  authority  limits  of  fuselage  aiming 
o  shoot  range. 

In  case  propulsion  control  is  automated  as  well,  additional  feedback  information  is 
not  likely  to  be  required. 

(2)  Post  stall  mode 

This  mod-:  requires  automated 
o  attitude  control 

o  g-load  and  angle  -if  attack  limitation. 

In  this  mode  the  information  feedback  to  the  pilot  becomes  extremely  critical.  The 
reason  therefore  is  the  extreme  departure  of  the  trajectory  from  the  attitude  of 
the  aircraft.  This  results  in  an  excessive  incompatibility  of  the  visual  and  the 
proprioceptive  sensational  information  of  the  pilot.  To  prevent  pilot  disorienta¬ 
tion,  this  mode  requires: 

o  proprioceptive  feedback  about  going  into  and  leaving  the  poststall  mode 

o  display  of  information  on  the  relation  between  attitude  and  trajectory 

o  display  of  information  regarding  the  state  of  the  aircraft  within  the  mode's 
autor i t y  limits. 

Concluding  Remarks 

New  sensor,  flight  control  and  attack  functions  require  cockpit  integration  and  a 
considerable  amount  of  automation.  Therewith  the  pilot's  task  is  reconfigured  and  the 
workload  is  kept  on  an  acceptable  level.  To  enable  the  pilot  to  fully  deploy  his  skills 
in  such  a  system,  further  cockpit  system  functions  are  required,  such  as:  pilot  error 
management,  and  display  of  specific  feedback  information  in  conjunction  with  data  hand¬ 
ling,  and  with  the  new  flight  control  and  attack  modes.  -These  cockpit  system  function 
requirements  are  discussed. 
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Fig.  3  Augmented  system  (F-4) 


Fig.  5  Number  of  displays  in  the  pilot's  cockpit  over 
the  generations  of  fighter  aircraft 
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MODERN  FLIGHT  INSTRUMENT  DISPLAYS  AS  A  MAJOR 
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SUMMARY 

Consideration  of  the  major  causes  of  flying  accidents  over  which  the  airframe  and  engine  manufacturers 
can  exert  a  powerful  influence  sh.nws  the  following  list  : 

1.  Structural  Failure 

2.  Engine  Failure 

3.  Flying  Control  Failure 

4.  Instrument  Failure 

5.  Pilot  Error  • 

With  the  first  three  of  these  causes  -  Structural,  Engine  and  Flying  Control  failures  -  while 
mistakes  do  occur,  the  manufacturers  have  a  reasonable  record,  there  is  no  evidence  of  complacency,  and 
in  addition  there  is  a  large  well  established,  government  controlled,  national  bureaucracy  offering 
valuable  checks  and  advice  on  testing  and  airworthiness  certification.  Pilot  error  in  different,  but 
appropriate  ways,  also  attracts  much  effort  aimed  at  its  reduction.  Most  importantly,  so  far  as  the 
purposes  of  this  paper  are  concerned,  the  accident  trends  related  to  the  first  three  causes,  as  well  as 
those  due  to  pilot  error,  do  not  appear  to  have  changed  fundamentally  during  the  last  decade.  The  same 
cannot  be  said  of  instrument  display  related  accidents. 

Since  the  advent  of  Head  Up  and  computed  displays  in  general,  and  the  operator's  real  need  to  expand 
the  non-visual  manoeuvre  envelope,  there  has  been  a  marked  increase  in  display  related  accidents/incidents 
in  both  operational  and  development  flying. 

This  note  suggests  that  attempts  at  curing  the  problem  have  been  based  on  a  false  assumption  that  has 
ignored  the  reality  of  the  piloting  task  in  modern  high  performance  jet  aircraft.  Proposals  are  offered 
to  improve  the  situation  by  both  engineering  and  organisational  changes. 


1.  THE  SITUATION  IN  THE  1950' s 

Service  aircraft  used  traditional  mechanical  and  electromechanical  direct  reading  individual 
instruments  with  well  understood  limitations  and  failure  modes.  Some  accidents  occurred  due  to 
misreading  particularly  of  altimeters.  The  operators  asked  for  a  greater  manoeuvre  envelope  while 

flying  on  instruments  as  well  as  improved  display  forms  to  reduce  pilot  error  problems. 


2.  THE  SITUATION  IN  THE  1960's 

Head  down  OR  946  instrument  displays  started  to  be  used  extensively.  These  were  easier  to  read  and 
with  the  us**  of  Master  Reference  Gyros  gave  an  improvement  in  manoeuvre  capability.  They  brought  some 
new  failure  problems  and  aircraft  fitted  with  them  were  at  times  restricted  to  visual  conditions  while 
improvements  were  incorporated.  However,  the  overall  situation  was  not  fundamentally  changed  from  that 
existing  in  the  1950's. 


3.  THE  SITUATION  IN  THE  1970' s 

The  first  aircraft  to  be  fitted  with  Head  Up  Displays  as  a  primary  instrument  flying  reference  entered 
service  in  1969.  The  head  down  instruments  were  limited  in  nature  and  number  and  were  conceived  as  get 
you  home  standbys  to  be  used  in  the  event  of  HUD  failure. 

Head  Up  Displays  as  fitted  to  the  aircraft  in  the  early  1970' s  showed  quite  fundamental  differences 
from  previous  flight  instrument  displays.  These  were  : 


(a)  The  symbology  was  very  easy  to  use  and  for  any  given  manoeuvre  gave  a  large  reduction 
in  instrument  flying  pilot  workload. 


(b)  The  freedom  from  roll  and  pitch  limitations  given  by  the  inertial  platform 
attitude  reference  sources  encouraged  pilots  to  manoeuvre,  without  visual 
references,  more  violently  than  previously. 

(c)  The  data  displayed  could  be  wrong  without  this  being  in  the  least  apparent 

to  the  pilot.  (For  instance  because  the  display  wave  form  generator  correctly 
processed  an  input  that  was  itself  incorrect.)  Such  correctly  WRITTEN  information 
looked  totally  valid  to  the  pilot. 

(d)  The  displays  could  be  quite  compelling. 

(e)  The  reliability  of  the  overall  display  system  proved  to  be  very  low.  It  was  not 
unusual  for  individual  pilots  to  experience  some  sort  of  failure  each  month. 


4.  REACTIONS  TO  THE  SITUATION  IN  THE  1970' s 

The  reaction  of  all  interested  parties  to  this  unprecedented  lack  of  reliability  was  to  stop 
considering  the  HUD  as  the  primary  flight  instrument  display  and  to  call  for  the  pilot  to  cross  refer 
between  the  HUD  and  the  standby  instruments. 

In  the  writt?r's  view  this  is  where  we  went  wrong. 

This  solution,  which  called  for  the  pilot  to  cross  check  various  displays  to  establish  which  were 
serviceable,  ignored  several  important  facts  : 

(a)  In  conditions  of  high  workload  the  pilot  will  abandon  all  but  essential  tasks  and 
revert  to  the  easiest  display  from  which  to  get  the  information  he  needs. 

Unquestionably  this  will  be  the  HUD  symbology  since  it  includes  nice  easy  to  use 
items  such  as  inertial  vertical  speed,  climb  dive  angle,  velocity  vector  and  so 
forth.  THIS  LEADS  AUTOMATICALLY  TO  THE  LEAST  RELIABLE  INFORMATION  BEING  RELIED 
UPON  AT  ALL  TIMES  OF  CRITICAL  PILOT  WORKLOAD. 

(b)  At  times  the  head  down  instruments  can  topple,  as  they  tend  to  have  restrictive 
manoeuvre  limits,  leading  to  confusion  if  cross  reference  is  used,  and  the  chance 
that  the  pilot  will  believe  the  more  reliable  head  down  displays  which  are  this 

time  wrong  because  the  original  manoeuvre  was  one  that  only  the  HUD  system  could  cope 
with. 

(c)  Cross  reference  between  several  displays  makes  instrument  flying  HARDER  NOT  EASIER. 

It  can  force  good  old  fashioned  mistakes  associated  with  scan  failures  between 
various  parameters  BECAUSE  THE  PILOT  WAS  SCANNING  FOR  CROSS  REFERENCE  PURPOSES 
between  head  up  and  head  down  examples  of  the  same  parameter. 

The  writer  firmly  believes  that  it.  is  unrealistic  to  rely  on  the  pilot  cross  checking  various  read 
outs  of  nominally  the  same  information  in  order  to  establish  serviceability.  One  recent  classic  example 
of  where  a  3  man  crew  equipped  with  l  attitude  references  did  not  notice  that  the  handling  pilot  was 
following  an  incorrect  one,  was  the  Air  India  747  that  rolled  inverted  and  crashed,  shortly  after  a  night 
take-off  out  of  Bombay. 


GENERAL  PROPOSALS  TO  IMPROVE  THE  SITUATION 
(a)  Engineering 

Ideally  the  flight,  data  should  be  multiplexed,  the  validity  of  data  should  be  decided 
automatical ly  in  the  back  of  the  aircraft  and  the  pilot  she  !d  be  presented  with  this 
reliable  data  through  both  held  up  and  head  down  displays.  There  is  no  justification 
for  treating  cockpit  display  data  as  somehow  less  important  than,  say,  wing  spar  strength 
or  the  signal  to  the  tail  pi. me  jack  in  luto  terrain  following  or  auto  land  cases. 

Since  the  ideal  solution  will  require  much  time  and  cost  to  icorporate,  an  interim 
solution  offering  some  level  of  improvement  (over  rhe  present  case  of  hoping  the  pilot 
spots  which  instrument  or  symbol  is  out  of  step  with  the  rest)  is  to  have  duplex 
systems  with  a  monitor  lane  that  warns  the  pilot  through  an  audio  warning  that  a  display 
disagreement  exists.  Leaving  him  to  use  his  skills  to  diagnose  which  display  is  at 
fan  1 1  . 

In  this  connection  the  Royal  Aircraft  Establishment  Farnborouqh  have  started  work  on  how 
to  tell  the  pilot  visually  that  a  flight  instrument  system  failure  has  happened.  Even 
this  task  has  been  harder  than  expected,  I  or  instance,  writing  a  large  cross  on  the 
display  is  certainly  attention  getting,  but  in  some  flight  trials  pilots  have  momentarily 
tried  t.o  use  the  failure  indicating  cross  as  a  reference.  Merely  removing  the  invalid 
information  from  the  display  has  been  shown  to  be  t<>o  weak.  In  this  case  too  much  time 
can  ['ass  before  the  pilot  realises  it  has  been  removed.  Time  which  had  he  been  ALERTED, 
muld  have  been  used  to  avoid  a  subsequent  critical  situ.it  ion. 


( b)  Organisational 


Because  modern  displays  can  use  several  discrete  black  boxes  in  series  to  produce  the 
end  result ,  NO  ONE  MANUFACTURER /DESIGNER  MAY  BE  RESPONSIBLE  FOR  MORE  THAN  ONE  ELEMENT. 
Because  each  component  manufacturer  is  in  turn  only  interested  in  showing  that  his 
element  meets  the  speci f ication  requirements  placed  on  him,  the  full  interactions  of 
tha  total  system  may  not  be  appreciated,  especially  the  knock  on  effect  of  any  changes 
that  may  be  made  in  isolation  in  one  box.  By  its  nature,  this  sort  of  problem  is 
less  likely  to  occur  in  Structure,  Engine  and  Flying  Control  disciplines  (But  watch 
out  for  fly-by  wire) . 

The  effects  of  limited  responsibility  for  one  link  in  the  chain  can  only  be  mitigated 
by  instituting  an  overall  system  co-ordinat ion  function  that  must  itself  exist  in  all 
of  the  interested  organisations  -  manufacturers ,  airworthiness  authority  and  customer  - 
if  the  full  checks  and  balances  that  we  have  come  to  rely  on  for  Structures,  Engines  and 
Controls  are  also  to  be  available  for  Flight  Instruments. 


fo.  CONCLUDING  REMARKS 

At  present  it  is  a  sad  fact  that  with  some  modern  aircraft  only  the  President  of  a  Board  of  Inquiry 
has  the  motivation  combined  with  the  authority ,  to  investigate  the  total  system  operation  so  far  as 
displays  are  concerned. 

We  must  develop  the  deep  infrastructure  for  displays  that  exists  in  other  aircraft  design  disciplines. 
From  the  standpoint  of  aircraft  survival,  instrument  displays  merit  at  least  the  level  of  emphasis  accorded 
to  structural,  engine  or  control  factors. 

No  relevant  authority,  research  establishment,  licencing  organisation,  manufacturer  or  operator 
should  be  content  with  the  present  situation.  It  is  no  longer  responsible  to  keep  telling  pilots  to 
cross  check  better,  and  to  imply  that  if  they  crash  through  a  displays  problem,  then  they  are  in  some 
way  not  professional  enough  in  their  approach  to  flying. 
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Since  IV7fc>  the  Royal  Netherlands  Air  force  lias  gained  <i  lot  of  experience  in  handling 
a  totally  new  aircraft,  the  I  -ldf  which  differs  in  nany  aspects  from  its  predecessors. 

Not  onl  \  the  pilots,  aut  the  tci’hn  ic  ion:,  too,  hail  to  adapt  themselves  to  the  new  air¬ 
craft  and  they  learned  how  to  handle  cut  ire  I s  new  systems. 

The  I  -Id  i  ;;  a  modern  hiqh  performance  fighter,  like  the  f  -14  arid  the  I  -lb,  and  has 
caused  problems  for  the  pilots  in  comparison  with  former  types,  the  f  -104  and  the  Nf  -b. 
The  extreme  mobility  of  the  aircraft  produces  not  only  a  hiqh  gravity  factor  as  such, 
but  also  a  raj)id  C  onset,  rate,  by  wfiicb  a  number  of  qra\  ity  depending  physiological 
problems  have*  arisen  in  a  very  obvious  wav.  I  ur  t  he  i  mo  re  as  .1  result  of  many,  t  echm>  1  ug  i  ea  I 
innovations  applied,  i.e.  .i  i  rcraf  t  '  r,  electronics,  t  hi  pilot's  task  has  also  ehanqod 
con s i dc r ah  1 v ,  in  particular  with  respect  to  the  amount  of  i n f o r na t  i o n  to  be  processed. 

The  question  arises  of  wether  new  a pp r o  ae  he  s  should  be  introduced  into  the  selection, 
t  he  p  hy  s  i  o  1  oq  j  e  a  l  standards,  the  traininq,  the  superv  is  ion  and  I  fie  coaching  of  the 
ope  r  a  t  i  on  .i  1  pilots. 

1YH>_S  I  NM)C  J  T  OR  S 

Mnost  all  problems  on  the  ph  y  s  1  o  l  oq  i  ea  1  ,  the  medical  and  t  lie  pa  t  ho  1  oq  i  e  a  1  field  have 
someth inq  to  do  with  uravitv. 

Anv  hum, in  is  able  to  withstand  in  an  untrained  status  and  without  aids  an  acre  1  e  r  a  t  i  ori 
of  I,  b  -  4,  b  C,  in  the  head  to  foot  direction  (  •  G/  )  .  Ae  ce  1  e  r  a  l  i  o  n  is  defined  by  Webster’s 
dictionary  as  M  a  rhanqe  of  \  e  1  oe  i  l  y  ,  or  t  he  rate  of  such  clianqe,  either  .is  regards  rate 
or  direction  or  both”.  The  force  of  gravity,  or  G ,  is  it's  unit  of  measurement. 

It  would  probably  he  opportune  here  to  explain  the  different  types  of  G  sectors: 

►  f.  /  i  s  f  oo  t  t  o  lie  ad  . 

\ivcl  cr.it  ion  or  Eyeballs  down':  -G/  is  head  to  foot. 

Acceleration  or  'eyeballs  up':  *  G\  is  back  to  front. 

\cc  e  1  r  r  .i  t  i  o  n  or  '  e  y  e  b  a  1  I  s  in':  -G  x  is  front  to  back. 

Acceleration  or  'eyeballs  out'  and  •  Gv  are  acceleration  forces  applied  from  the  left  or 

l  fie  right  and  cnnsccuciit  h  'eyeballs  'left'  or  'right'. 

When  evaluating  I’.-tiilcrance  levels,  tine  must  consider  the  following  parameters:  direction 
of  G  vectors,  diir.it  ion  of  G,  magnitude  of  0,  t  i  no  at  peak  G,  rate  (if  G  onset  and  decay, 
endpoint  of  tolerance  selected,  e n\  i r o nme n t a  1  conditions  present,  anti-G  mechanisms 
used,  body  positioning  and  the  mot  jv.it  inn,  eo  rid  i  t  i  o  n  i  tig  and  t  r  a  i  n  i  n  g  of  the  pilots. 

In  flying  t  tie  1  - 1 the  •  G/  and  -  G/  is  of  interest.  •  G/  causes  fatigue,  perspiration, 
cough  (especially  if  oxygen  is  being  used),  a  feeling  of  warmth,  calf  pain,  Peripheral 
light  loss.  Central  light  loss,  loss  o  f  hearing  and  u  neon  sc  i  o  u  s  lie  s  s  ,  occasionally  w  i  t  h 
convulsion*,,  in  that  order  ,  As  mentioned  before  humans  can  easily  withstand  deceleration 
forces  up  to  •  4 , b  G  / ,  still  accelerating  t he  pilots  develop  the  af or e -me n t i o ned  problems 
bee.iu.se  the  pulse  pressure  (systolic  ml  nu  s  diastolic  pressure)  is  no  longer  suffieiant 
*  o  forci-  blood  to  the  head,  this  is  due  to  the  increase  in  weight  caused  by  high  G  load. 

I  he  eye  is  t  fie  first  organ  to  deteriorate  beeiuse  the  normal  eye  pressure  of  almost  l0  mm 
Hg  is  increased,  t  iienf  ore  it  might  he  better  to  warn  pilots  in  cases  of  emergency  by 
aeons!  i  c  a  1  signal  s  and  not  primarily  n>  <  i ■■  i  ion  I  i  g h  t  s  . 
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I  1 1  r  t  hr  r  mo  r  e  ,  h x  po  t  hi*  r  in  i  .t  i  1 1  < '  re  .1  si-  s  C  I  uiiT.iiu'r  ;  dc  h  x  d  r  a  l  inn,  il  i  e  l  .1  r  \  r  * ’  ■■ f  r  i  <  <  i  on  ■ 1  '■  s  ■  <  d  i  i 

heat  stress,  pro  1  onijrd  bedrest  and  sunburn  ‘Irn'c.i  '.c  C  t  o  1 e  r  .nice  . 

1  fu-  1 1  i  ,j  1 1  .  {]/  omm'I  r.tt  f  of  1  tic  b  i  1  h  piT  hifiMiH-c  I'  i  >1  ii  1  i'  r  aircraft  »*<*•■  s  n  < »  1  a  I  I  >  ■  w  >  •'  .  -  •<  »  . 
to  .iiH'iii’iruul.il  i1  in  l  In-  p t‘  o  jn-  r  w  .  1  \  ,  l  in-  r  «•  I  it  re  N  -  1  o  1 e  r  .111 1 '  >  •  v\  i  1  1  In  >1 1  ■  c  r  •  ■  <1  '■<  -  <■  b  x  1  >  '  ■  >  0  1  . 

will)  a  ',|  iiAfT  o  n  se  1  r  .t  I  i  ■  .  H  i  1  j  It  sir.l  .1  i  [ml  U  <  •  .1  n  c  a  >  1  se  Siinr  i  r  r  e  |  u  1  >1  r  i  I  i  « •  s  in  :  u  •  ar  ’  '  1 1 .  ‘  * 

I  nicli  I  irliiT  f  omul  a  a  h  ax  i  l  a  t  i  o  n  d  rpcml  i  no  \S  o  1  !  I’.irki  iibun  rtli  i  t  r  p  r  c  *  \  *-  i  t  a  l  i  o  n  <  •  o  n  d  u .  !.  i  ■  -  n 

ii.tt  t  «tii  ;  IV  ii  i  nnr  r  y  dr  sc  r  i  hr  d  coincident  1  o  s  s  o  f  run  sc  i  <i  n  s  n»-  s  •,  and  \  *•  1,  t  r  i  -  n  !  a  r  t  a  c  h  y  .  r  1  i  j 

d  II  r  i  n  1 1  •  n  S  t  r  r  •.  s  d  nr  U)  .in  i  mb  a  1  a  net:  fit  t w  r  r  n  5  y  :iiji  a  l  he  t  i  r  .Hul  ji  .1  r  .1 y  np  a l  ne  l  i  *  1  nrir  , 

l  spe  r  i  u  1  1  y  sport  sme  n  or  pilots  in  \i:r\  pood  p  1 1  \  s  i  c  .1  1  cunili  (  inn,  a  1  sed  by  r  1.0  >.  r  a i.  •  c  - 

sports,  (Mil  show  .in  increased  vital  I  mu*,  which  seems  to  he  t'u-  r  (  i  u  I  •>  j  y  of  t  nr  in-  ir! 

r  v  t  h  inn  disturbance's.  V  r  1 1  r  s  and  V  i  o  i  1  i  e  f  ond  found  that  hear!  rate  i  1  m  •  r  r  a  sr  .  a  J  w  .j  x  *.  1  i  - 

sr  r  v  r  d  d  ■  1  r  i  in;  .nv  c  I  e  r  a  t  i  o  n  ,  is  a  f  unci  ion  uf  a'nvlcral  i'lii  i  11 1  r  n  s  i  t  .  .  I  a  r  n  \  r  a  r  d  i  a  i  •  an 

i  nimr  d  i  a  t  r  reflex  r  r  r»p  o  n  sc  o  r  i  11  i  11  a  t  i  no  in  the  carotid  and  aortic  ha  r  o  r  r  c  r  p  t  o  r  s  .  I  ! .  <  a  r  - 

diac  is  reduced  by  at  -  4C/  and  by  J4  b  at  -  'H.  /  in  spite  of  t  a  e  h  y  c  a  r  d  i  a  . 

So  ne  heart  sy  ndrunes  will  produce  a  r  r  v  t  hm i a  s  e  .  0  .  the  n  i  d  systolic  click  -  I  ♦  .  s  *  ■ ,  r  >  ■  [  . 

ciurnnr  syndrome,  assoei  lied  with  dysfunot  ion  of  the  mitral  v.ilw,  can  oive  \eihr  ic'-l  -11 
t  acli  y  c  ar  d  \  a  or  ventricular  hioeminy.  llirrn'ore  mitral  valve  prolapse  makes  the  pilot  ui- 
fit  for  hioh  pe  r  f  o  r  mo  ncr  aircraft#  Whinnrry  found  an  \-A  dissocial  i  an  durino  L!m' 
exposure  poses  no  sionifieanl  risk  >r  »*.iriliai*  daman**  in  humans  ano  it  will  h»-  -  ’  ■ 

flight  su  i*  pe  o  n  s  to  seleet  mil  \  those  pilots  who  can  withstand  •  C.  /  stress  and  w  u  ,  a  r  < 
c  ii  :-ip  l  e  t  e  l  y  Ii  e  a  1  t  h  x  .  f  imp  let  e  I  \  ,  be  e  a  u  sr  pilots  who  Miffer  with  relatively  mild  or 

su  hr  l  i  n  i  ca  1  ilesc.i.e:.  nay  liceone  suddenly  i  iiCupac  i  t  a  1  rd  as  a  result  of  hi;-.  sustain*  d  ./, 

Mills  and  Marks  have  i  nv  c  s  t.  i  <1  a  l  <•  d  the  effect  o  t  .icec  leral  ion  stress  upon  the  c  m «  e  n  ■  r  .1  - 

t  i  ii  1 1  of  various  ho  r  mo  ne  s  in  pe  r  i  pt»e  r  a  1  blood.  No  s  i  «i  n  i  f  i  c  a  n  t  c  h  a  n . ;  e  r.  wire  seer,  j  u  t.h*- 

i  e  v  c  l  s  of  OH,  IMi  I  ,  F  SH  ,  t  II  and  ISM.  Ch  a  no  e  s  in  se  run  curt  i  so  1  were  s  i  o  n  i  f  !  c  1  1 1  w  :  t.  1 

peak  values  aci’iir  i  in  ,'d  ninut.es  after  acre  1  e  r  a  t  i  o  n  stress.  T  ’■■■<■  t  ■■  s-  ■  u  ■ '  c  o  !  s  i  :  n  i  1  ;  •  •  a  ;d 

•  luiii'ie  :i  in  ti  M  or  I*  hi  is  not  in  accor  «i  v\  i  t  h  ciirnn!  ■  ■  ■  i  ilence  ttiat  *  •  u  .  ■  r>  "si  is  ,  •.  . :  - 

isiiie  s "  . 

hud  ln'r  problem.  I  he  r  e  t.  r  o  -  h  y  pe  r  t’  1  e  \  i  on  l  u  \  a  t  ion  of  to-.  •  t  r  v  i  ^  a  l  spine,  ■«  a  s  .1  i  ism.I,  :  n  •  r  > 

found  after  e  j  e  c  t  i  o  n .  Hut  sudden  h  i  u  h  •  C  /  l  o  id  s  in  tin*  new  f  i  »i  1 1  e  r  ,i  i  is'rai  (  1  .1  •  1  ,  >  t’u  >1  ■  1  ■■  e 

t  ne  same  results.  This  tia  pp  en  s  when  the  torso  is  relatively  fixed  hr  c  a  o  s»  of  ii*.  it  t  i  —  - 
nienl  to  the  seat  and  the  head  is  in  a  relatively  fixed  position  because  •  f  '  ,e  1  **  I  -d 

which  will  lie  pressed  a  a  a  i  11  s  t  the  he  a  d  r  e  s  t  .  1  he  n  the  neck  is  free  to  ■ .  •  \  ■  •  .  I  :  j  1  : .  •  ■  r  -i.o  r  <  •  , 

the  antero  -  later*)  -  h  y  p  e  r  f  l  e  x  i  o  h  ,  which  causes  extreme  i.-.a  sen  1  a  r  ,1.1  i  •  -rt  .a, 

lire  an  se  the  •  f./  I  o  .id  is  not.  only  work!  lu]  on  t.  he  head  hut  on  the  :o  1  «  !  too,  [1  t  n  :  0  .  n 

:  'u  s<  1  c  s  arc  not  Strom;  r  no  u.jti  t  .I  w  i  t  h  «;  I  a  nd  the  tore*:.,  a  hix.d  !>?';  ■  f  is*  •  e  r  v  i  -  a  l  i  • .  1  i 
rolunn  or*  sprain  of  »  he  cer\i»’al  nus«*J«s  will  tie  caused. 

\  new  t  y  pe  of  tie  1  ne  t  is  mow  he  i  m  i  id  nwt'.sss!  in  t  h"  li  U  \  i  .  I'm-  %x » •  i  ;h  \  of  *  hr  el  iu- 

c  t  1 1  d  i  n  a  the  v  i  so  r  0 ,  o  \  y  ;e  n  mask  »•  t  c  .  ,  will  be  reduced  '  •  . 

leveret!  describe*!  *•  >  1 1  a  ne  ou  s  pcte«'tiial  he  no  r  r  h  a*)e  s  in  the  t  Hit  of  '"inutc  p  i  it  -  «r  i  1  r  ;  c  • 

spots,  deeply  c  o  1  0  •  1  r  ed  ,  toil  painless  d  i  S  1  pp  e  a  r  i  na  s  p «)  n  t  a  ne  o « 1  s  l  .  in  a  few  d  a  v  ■» .  h  |C  [  r .  - 

iuries  mostly  oc«*iir  in  the  lower  part  of  the  body  ate  t. '  e  inderams  . 

It  i  ti  curious  that  pe  t  ec  h  i  a  1  homo  r  r  h  a  1  <■  s  seen  i  ■»  v  e  1  op  in  the  firs'  •<  i  h  p  •*  r  t  ..••••  a  « 

-i  i  s  s  i  o  n  s  •  After  so  "ie  «*  x  pe  r  i  e  nee  in  f  I  \  i  no  t  h  i  s  »  t  .  ;><-  of  1  i  r  c  r  a  t  ■  pi-  *  •  c  i  a  1  ’ . .  j-  j-  ■  1  ; ,  • 

are  seldom  seen,  it  i  n. »  t  r;  u  r  p  r  i  s  i  n  tj  I  I*  a  t  due  to  the*  p  I  x  r.  i  o  1  »  ;  i  -1  1  problems  in  hi  t  h 

pe  r  f  or  na  nee  .1  i  r  c  r  a  f  *  f  I  v  i  na  the  f  1  i  ■’  !i  t  ;*  f.  x  s  i  c  a  1  s  l  a  ml  a  r  d  s  h  ac  l  •  ■  ;  -  -  w  r  c  .  rn  s  i  ce  s  a- 

e  x  t  e  n  r»  i  v  e  initial  e  \a  m  i  na  t  i  on  i  r  (  the  Net  lwrl.nr!:.  a  t  o  *  a  I  spine  \  -  r  » »  J  • .  •’.»»!<'  in  order  t  .  ■ 
ilcitiniist  rate  c  h  a  mte  s  in  Mu  I  o  nu  run,  an  I  I  f,  a  np  e  x  to  de.'non  s  t  r  1 !  e  1  ti  a  n  ;  e  s  ai  h  r  a  i  nf  u ;  1  c  *  !  ■<  . 
I  'll*  t  lie  r  nor  c  t  tie  re  is  an  intention  to  use  tin  human  ce  11 1  r  i  f  u  P  M,  hoe  s  1  e  r  he  r  I  ,  Holland  hit 

t  I'd  i  n  i  mi  <i  nd  seli'ct  pm  purposes.  After  renovation,  this  c  e  n  t  r  i  f  uij  e  will  he  c  a  p  1  h  i  e  o' 

be  j  n*  j  flown  by  the  pilot  u  s  i  11  1  t  a  V  <je  t  t  1  a  c  k  i  n  *1  on  1  t:s»>  n  i  to  r  inside  the  1  o  nd  <  >  1  a  . 

H  t  tie  r  countries  have  shown  interest,  in  u  s  i  n  i  this  emit  r  i  f  mje  as  well.  Sine*  L  s. 1  x  a  •  1  mu 

H  i  ude  1  a  a  r  and  m  se  l  f  nave  f  i  t  t  ed  Mu'  f  1  i  0  h  t.  p  hx  s  i  <  a  l  s  t  a  ml  *1  r  d  s  t  o  the  •  1  - '  w  a  i  r  *  r  a  f  t  ,  t  h<  y 

at*'-  almost  eq«ial  to  lie-  stand,  irds  for  hiph  pe  r  t  «nr  m.i  nee  aircraft  pilots  'mind  pr*>ju>sed  :x 
iiichn.inn  and  ot  tiers  to  the  US  M  . 

I  tie  I  -Jr.  usimj  countries  nave  been  united  in  the  "I  -l»»  M,  *lieal  Workinu  nr*»u|i",  uinler 
e  h  a  i  r  na  n  sh  i  p  *>f  "iy  r*e  »l  i  *•  a  I  i  n  spe  c  !  o  r  Air  Commodore  Ma.it  ,  U  ,  U  .  I  .  h  .  ,  se  m  i  a  ri  r*  .n»  I  n<*  *!  i  c  a  1 

problems  are  be  i  no  *l;scussed.  \  special  tr.i  i  ui  ii*i  pr«uiram  t.ised  01*  the  p  r  i  nc  i  p  l  e  s  of 

w  e  i  (jh  t.  I  i  f  t  i  no  has  been  developed  i  ri  order  to  s  t  re  n  o  t  ti  t  lie  .uu  s*’  1  e  s  which  arc  used  in  the 
M  1  Hii  ne  ii  v  e  r  • 

PSA  (  Hdl  Dt;  f  C  Al.  1  \C  l  OK  S 

In  recent  years,  i nc  re  a  s i no  societal  demands  for  safety  f  dope nd a l  i  t x  ,  economy, 
e  f  f  e  e  t  j  \  nr  s  r»  and  reduced  e  ne  r  )  x  *  *>n  *.  u  np  t  i  o  n  nave  increased  lie*  complexity  of  mi:  l  i  t  a  r  x 

t  I  y  i  no  operations,  I  tins  r>.i|  ui  fv  iie|  the  pressures  lor  pood  pilot  j  u  *1 0  me  <  1 1  . 

i  'i  r  I  he  r  mo  r  e  l  ertinul  o  1  ic.il  ad  x  .line  s  tdi.it  have  rased  much  of  t  ne  pilot's  burden  for  p  r  e  c  i  e 
a i r  e  r  a  f  t  eontrol  and  weapon  delivery  have  not  eased  tie*  pilot's  d  ec  i  s i o  n -na  k i n  0  w  o  r  k I o  a  d . 
In  many  eases  t  he  se  advances  have  only  ere.it  ml  d  e  mand  s  f  *>  r  ti  i  i|  tie  r  levels  of  skills, 

know  )  e  d  o  <•  and  J  -ido  me  n  t  for  which  few  pilots  have  been  trained,  l  lu-  e  f  f  r  c  t  s  are  distincti¬ 

vely  noticeable  i  n  two  area-.,  namely  : 

a  .  with  1  Q  spe  c  t  t  1)  the  p  s  x  ehiuml  of  skills,  I’urrl  x  manual  f  1  \  i  iuj  i  s  not  p  *.  s  S  i  I)  1  e  a  n  y  ma  r  *’  . 

TTorT*  TfiTl  rnTTr r,  (lie  pi  Vo  I  olfTx  oi^es  input  sional-.  t  o  l>e  tested  tiy  computers  for  ttirir 

ap  p  1  i  e  j  b  i  I  !  t  y  d  epe  rule  n  t  on  x  .1  r  i  a  b  1  e  s  »•  lii  *  h  arc  measured  l*e  x  o  n  d  the  c  o  n  t  r  o  1  of  the 
pilot,  Ovcri’or  rri’t  ions  and  a  number  nf  incorrect  inputs  are  not  all  owe*!  or  are  correct 
The  much  v  aunt  ed  "pilot  's  feel"  has  become  less  important.  1  h  i  s  way  of  flyimj,  ontfol 

led  for  1  n  s  t  a  nee  in  the  f  -  1  o  h  x  a  f  I  i  <j  Ii  t  ront  nil  computer,  can  cause  v  e  r  t  i  i]  o  ,  \  v  t  i  0  o 

is  a  sensat  ion  of  spinniiKj  wtiict'  max  he  caused  when  information  from  the  exes,  bo  \ 
orientation  and  other  sensations  are  not  « 1  1 x  in  j  the  same  informat  i 
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